CVE-2020-37123

CRITICAL
2026-02-05 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
PoC Detected
Feb 05, 2026 - 20:47 vuln.today
Public exploit code
CVE Published
Feb 05, 2026 - 17:16 nvd
CRITICAL 9.8

Tags

PHP RCE

Description

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

Analysis

Remote code execution via OS command injection in Pinger 1.0 allows attackers to inject shell commands through the ping target parameter. EPSS 12.2% indicates significant exploitation likelihood. PoC available.

Technical Context

CWE-78 OS command injection. User-supplied ping target is passed directly to a system shell command without sanitization, enabling arbitrary command execution.

Affected Products

['Pinger 1.0']

Remediation

Use parameterized system calls instead of shell execution. Validate input against IP address/hostname patterns.

Priority Score

81
Low Medium High Critical
KEV: 0
EPSS: +12.2
CVSS: +49
POC: +20

Share

CVE-2020-37123 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy