Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Playsms

First CVE: Dec 31, 2004Active for: 22 yearsTotal CVEs: 15
68.3
VTI Score
TOP TARGET

Playsms is a modestly represented open-source SMS gateway platform that occupies a niche deployment context but sits in a security-sensitive position where message routing, user input, and file handling create a direct path to injection and code execution. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, with a moderate tendency toward confirmed in-the-wild exploitation; the recurring weakness classes—code injection, injection variants, unrestricted file upload, and path traversal—reflect the dangers of permissive input handling and file-system operations in a messaging platform. Defenders using this gateway should prioritize patching and restrict network exposure, particularly for administrative interfaces; live severity, exploitation activity, and exposure counts are shown alongside this summary.

FAUCET AI Generated
15
Total CVEs
More Total CVEs than 94% of tracked vendors
1.7
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 79% of tracked vendors
7.8
Avg CVSS Score
Higher Avg CVSS Score than 74% of tracked vendors
6.7%
In CISA KEV
Higher KEV Rate than 100% of tracked vendors

Trends Over Time

The number and severity of CVEs published that impact products developed by Playsms over time

Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2004
21 years ago
Most Recent CVE
Sep 16, 2024
677 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (15 CVEs).

15 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2020-8644CRITICAL
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Feb 5, 20209.898YESYES
CVE-2017-9101CRITICAL
import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
May 21, 20179.886NOYES
CVE-2017-9080HIGH
PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code
May 19, 20178.879NOYES
CVE-2009-0103HIGH
Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) apps_path[plug] parameter to plugin/ga
Jan 9, 20097.532NOYES
CVE-2008-5881HIGH
Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) gatew
Jan 9, 20097.531NOYES
CVE-2022-47034CRITICAL
A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.
Feb 13, 20239.829NONO
CVE-2024-8880CRITICAL
A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&rout
Sep 16, 20249.828NONO
CVE-2004-2263HIGH
SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie.
Dec 31, 20047.528NOYES
CVE-2021-40373CRITICAL
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main
Sep 10, 20219.827NONO
CVE-2018-18387HIGH
playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse.
Oct 29, 20188.827NONO
View all 15 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products15 CVEs
20%
40%
33%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network11 (73.3%)
Unknown4 (26.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low11 (73.3%)
High0 (0.0%)
Unknown4 (26.7%)
User Interaction
None10 (66.7%)
Unknown4 (26.7%)
Required1 (6.7%)
Privileges Required
Low3 (20.0%)
High1 (6.7%)
None7 (46.7%)
Unknown4 (26.7%)

Exploit Exposure

Signals from CVEs in this vendor scope (15 CVEs).

CISA KEV
1 CVE
6.7% of CVEs· 100th percentile
Metasploit
3 CVEs
20.0% of CVEs· 99th percentile
Nuclei
1 CVE
6.7% of CVEs· 96th percentile
ExploitDB
7 CVEs
46.7% of CVEs· 81st percentile

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Playsms.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Playsms — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Playsms's Products

View all 2 CNAs →

Top CWEs