bslist.cgi mailing list script allows remote attackers to execute arbitrary commands via shell metacharacters in the email address.
https://exchange.xforce.ibmcloud.com/vulnerabilities/5797
https://euvd.enisa.europa.eu/vulnerability/EUVD-2001-0100
http://archives.neohapsis.com/archives/bugtraq/2000-12/0390.html