{"cve":"CVE-2020-8644","epss":{"score":0.86308},"kev":{"dateAdded":"2021-11-03T00:00:00+00:00","dueDate":"2022-05-03T00:00:00+00:00"},"mitre":{"cpes":[],"created":"2020-02-05T21:03:11+00:00","description":"PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2020/8xxx/CVE-2020-8644.json","references":["http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html","https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704","https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/","https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/"],"title":null,"updated":"2025-10-21T23:35:52.570000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:playsms:playsms:*:*:*:*:*:*:*:*"],"created":"2020-02-05T22:15:11.003000+00:00","description":"PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.","metrics":{"cvssV2_0":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2020/CVE-2020-8644.json","references":["http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html","https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704","https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/","https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8644"],"title":null,"updated":"2026-06-17T03:26:41.917000+00:00","vendors":["playsms","playsms$PRODUCT$playsms"],"weaknesses":["CWE-94"]},"opencve":{"changes":[{"created":"2025-02-04T21:15:00+00:00","data":[{"details":{"added":{"kev":{"dateAdded":"2021-11-03"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"64fa22d3-efd2-4969-a675-9486dca06002"},{"created":"2025-10-21T19:30:00+00:00","data":[{"details":{"added":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8644"],"removed":[]},"type":"references"}],"id":"fc25c256-afe5-489c-a67c-4c78a8ef6289"},{"created":"2025-10-21T20:30:00+00:00","data":[{"details":{"added":[],"removed":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8644"]},"type":"references"}],"id":"06ff61a0-6660-4559-9684-9f9a60c8dbd1"},{"created":"2025-10-22T00:30:00+00:00","data":[{"details":{"added":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8644"],"removed":[]},"type":"references"}],"id":"8aec8602-d016-4277-812e-02dc2e79da4b"}],"cpes":{"data":["cpe:2.3:a:playsms:playsms:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2020-02-05T21:03:11+00:00","provider":"mitre"},"description":{"data":"PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{"score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},"provider":"nvd"},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"vulnrichment"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.86308},"provider":"first"},"kev":{"data":{"dateAdded":"2021-11-03T00:00:00+00:00","dueDate":"2022-05-03T00:00:00+00:00"},"provider":"cisa"},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html","https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704","https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/","https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8644"],"providers":["mitre","nvd","vulnrichment"]},"title":{"data":null,"provider":null},"updated":{"data":"2025-11-07T22:04:10.590000+00:00","provider":"nvd"},"vendors":{"data":["playsms","playsms$PRODUCT$playsms"],"providers":["nvd"]},"weaknesses":{"data":["CWE-94"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2020-02-05T21:03:11+00:00","description":"PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{},"kev":{"dateAdded":"2021-11-03"},"ssvc":{"options":{"Automatable":"yes","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"}},"references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8644"],"title":null,"updated":"2025-02-04T20:19:16.496000+00:00","vendors":[],"vulnrichment_repo_path":"2020/8xxx/CVE-2020-8644.json","weaknesses":["CWE-94"]}}