Vulnerabilities
Summary — last 7 days
New vulnerabilities4,622▼ 808 vs. last week
Critical / high1,741▼ 1,357 vs. last week
New active exploitation (KEV)8▼ 1 vs. last week
Unscored (no CVSS)957▲ 858 vs. last week
More filters
9 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | Critical (9.8) | 4.7% | PoC | Playsms | 9/10/2021 | 6/17/2026 | playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main&inc=core_welcome URI. | |
| Analyzed | Critical (9.8) | 87% | ⚠ Active exploitationExploit | Playsms | 2/5/2020 | 6/17/2026 | PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. | |
| Modified | High (8.8) | 1.8% | PoC | Playsms Project Playsms | 10/29/2018 | 6/17/2026 | playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse. | |
| Modified | Critical (9.8) | 77% | Exploit | Playsms | 5/21/2017 | 6/17/2026 | import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file. | |
| Modified | High (8.8) | 62% | Exploit | Playsms | 5/19/2017 | 6/17/2026 | PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection. | |
| Modified | High (7.5) | 10% | Exploit | Playsms | 1/9/2009 | 6/16/2026 | Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) apps_path[plug] parameter to plugin/gateway/gnokii/init.php, the (2) apps_path[themes] parameter to plugin/themes/default/init.php, and the (3) apps_path[libs] parameter to… | |
| Modified | High (7.5) | 7.3% | Exploit | Playsms | 1/9/2009 | 6/16/2026 | Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) gateway_module parameter to plugin/gateway/gnokii/init.php and the (2) themes_module parameter to plugin/themes/default/init.php. | |
| Modified | Medium (4.3) | 2.0% | Exploit | Playsms | 12/21/2005 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in index.php in PlaySMS 0.8 allows remote attackers to inject arbitrary web script or HTML via the err parameter. | |
| Modified | High (7.5) | 1.4% | Exploit | Playsms | 12/31/2004 | 6/16/2026 | SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie. |