I-Man 0.9, and possibly earlier versions, allows remote malicious users to execute arbitrary PHP code by uploading a file attachment with a .php extension.
yvesglodt i-man