CVE-1999-0146

CVE-1999-0146 describes a critical command injection vulnerability in the NCSA campas CGI program, affecting NCSA web servers. An unauthenticated attacker could execute arbitrary commands by injecting encoded carriage return characters into the query string, potentially leading to full system compromise. With a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, allowing for partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit (EDB-20423) is publicly available, though there is no evidence of active exploitation or significant community discussion.