• This script is possibly vulnerable to Email injection attacks.
  
  Email injection is a security vulnerability that allows malicious users to send email messages using someone else's server without prior authorization. A malicious spammer could use this tactic to send large numbers of messages anonymously.

• You need to restrict CR(0x13) and LF(0x10) from the user input. Check references for more information about fixing this vulnerability.

• • Email Injection
  • PHP mail() Header Injection Through Subject and To Parameters

• 

• CWE-20

• Abuse Of Functionality

• DotNetNuke multiple vulnerabilities
• PHP unserialize() used on user input
• HTML injection
• Unprotected phpMyAdmin interface
• File upload XSS (Java applet)