Playsms
Vendor:
First CVE: Dec 31, 2004 · Active for 21 years
15
Total CVEs
Bottom 1%
1.7
Avg CVEs / Year
Bottom 1%
7.8
Avg CVSS
Higher Avg CVSS than 79% of tracked products
6.7%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Playsms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2004
21 years ago
Most Recent CVE
Sep 16, 2024
676 days ago
CVE Severity & Scoring
Playsms15 CVEs
20%
40%
33%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network11 (73.3%)
Unknown4 (26.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low11 (73.3%)
High0 (0.0%)
Unknown4 (26.7%)
User Interaction
None10 (66.7%)
Unknown4 (26.7%)
Required1 (6.7%)
Privileges Required
Low3 (20.0%)
High1 (6.7%)
None7 (46.7%)
Unknown4 (26.7%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-8644CRITICAL PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. | Feb 5, 2020 | 9.8 | 98 | YES | YES |
CVE-2017-9101CRITICAL import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file. | May 21, 2017 | 9.8 | 86 | NO | YES |
CVE-2017-9080HIGH PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code | May 19, 2017 | 8.8 | 79 | NO | YES |
CVE-2009-0103HIGH Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) apps_path[plug] parameter to plugin/ga | Jan 9, 2009 | 7.5 | 32 | NO | YES |
CVE-2008-5881HIGH Multiple directory traversal vulnerabilities in playSMS 0.9.3 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) gatew | Jan 9, 2009 | 7.5 | 31 | NO | YES |
CVE-2022-47034CRITICAL A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication. | Feb 13, 2023 | 9.8 | 29 | NO | NO |
CVE-2024-8880CRITICAL A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&rout | Sep 16, 2024 | 9.8 | 28 | NO | NO |
CVE-2004-2263HIGH SQL injection vulnerability in the valid function in fr_left.php in PlaySMS 0.7 and earlier allows remote attackers to modify SQL statements via the vc2 cookie. | Dec 31, 2004 | 7.5 | 28 | NO | YES |
CVE-2021-40373CRITICAL playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main | Sep 10, 2021 | 9.8 | 27 | NO | NO |
CVE-2018-18387HIGH playSMS through 1.4.2 allows Privilege Escalation through Daemon abuse. | Oct 29, 2018 | 8.8 | 27 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
1 CVE
6.7% of CVEs· Bottom 1%
Metasploit
3 CVEs
20.0% of CVEs· Bottom 1%
Nuclei
1 CVE
6.7% of CVEs· Bottom 1%
ExploitDB
7 CVEs
46.7% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For Playsms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.4.7 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.4.6 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.4.5 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.4.4 | 1 | 9.8 | 0.7% | 0 | 0 |
| 1.4.3 | 3 | 5.9 | 0.5% | 0 | 0 |
| 1.4 | 2 | 9.3 | 69.5% | 0 | 2 |
| 0.9.3 | 2 | 7.5 | 8.7% | 0 | 2 |
| 0.8 | 1 | 4.3 | 2.0% | 0 | 1 |
| 0.7 | 1 | 7.5 | 1.4% | 0 | 1 |
| 0.6 | 1 | 7.5 | 1.4% | 0 | 1 |