What is the CVSS score of CVE-2020-37141?

CVE-2020-37141 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2020-37141?

AMSS++ version 4.31 contains a critical SQL injection vulnerability that could allow attackers to access or modify sensitive database contents, including potentially confidential email data and user…

Is there a public PoC exploit available for CVE-2020-37141?

Yes, a public proof-of-concept exploit is available for CVE-2020-37141. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2020-37141?

Within 24 hours: Identify all systems running AMSS++ 4.31 and isolate affected mail modules from direct internet access; implement emergency WAF rules to block malicious SQL injection patterns on the maildetail.php endpoint. Within 7 days: Deploy network segmentation to restrict database access from the mail application server; enable comprehensive logging and conduct forensic review for signs of exploitation. Within 30 days: Evaluate migration to alternative email solutions or upgrade to a patched version when available; conduct full security assessment of affected systems.

PHP CVE-2020-37141

HIGH

SQL Injection (CWE-89)

2026-02-07 disclosure@vulncheck.com

PHP SQLi

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 09, 2026 - 16:08 vuln.today

Public exploit code

CVE Published

Feb 07, 2026 - 00:15 nvd

HIGH 8.2

DescriptionCVE.org

AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' parameter. Attackers can manipulate the 'id' parameter in /modules/mail/main/maildetail.php to inject malicious SQL queries and potentially access or modify database contents.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' parameter. Attackers can manipulate the 'id' parameter in /modules/mail/main/maildetail.php to inject malicious SQL queries and potentially access or modify database contents.

Affected ProductsAI

Component: mail.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.