Skip to main content

Playsms CVE-2020-8644

CRITICAL
Code Injection (CWE-94)
2020-02-05 cve@mitre.org
RCE Code Injection Playsms
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Added to CISA KEV
Jul 14, 2026 - 04:22 CISA
CVE Published
Feb 05, 2020 - 22:15 nvd
CRITICAL 9.8

DescriptionNVD

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

AnalysisAI

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. Affected products include: Playsms. Version information: before 1.4.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.

More in Playsms

View all
CVE-2017-9101 CRITICAL POC
9.8 May 21

import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User
CVE-2017-9080 HIGH POC
8.8 May 19

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. Rated high s
CVE-2021-40373 CRITICAL POC
9.8 Sep 10

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_con
CVE-2020-15018 MEDIUM POC
6.5 Jun 24

playSMS through 1.4.3 is vulnerable to session fixation. Rated medium severity (CVSS 6.5), this vulnerability is remotel
CVE-2024-8880 MEDIUM POC
6.3 Sep 16

A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Rated medium severity (CVSS 6.
CVE-2024-6469 MEDIUM POC
5.1 Jul 03

A vulnerability was found in playSMS 1.4.3. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable
CVE-2018-18387 HIGH
8.8 Oct 29

playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse. Rated high severity (CVSS 8.8), this vulnerabili
CVE-2024-6470 MEDIUM
5.1 Jul 03

A vulnerability was found in playSMS 1.4.3. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable
CVE-2024-6251 MEDIUM
5.1 Jun 22

A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Rated medium severity (CVSS 5.1), this

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8
CVE-2025-32432 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2020-8644 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy