Playsms

Playsms

14 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2024-8880

Exploit
  • EPSS 0.13%
  • Veröffentlicht 16.09.2024 01:15:10
  • Zuletzt bearbeitet 20.09.2024 16:41:38

A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation...

2.7

CVE-2024-6470

  • EPSS 0.1%
  • Veröffentlicht 03.07.2024 13:15:03
  • Zuletzt bearbeitet 05.04.2025 00:09:09

A vulnerability was found in playSMS 1.4.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php?app=main&inc=feature_inboxgroup&op=list of the component Template Handler. The manipulation of t...

8.8

CVE-2024-6469

Exploit
  • EPSS 0.13%
  • Veröffentlicht 03.07.2024 11:15:04
  • Zuletzt bearbeitet 21.11.2024 09:49:42

A vulnerability was found in playSMS 1.4.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?app=main&inc=feature_firewall&op=firewall_list of the component Template Handler. The m...

6.1

CVE-2024-6251

  • EPSS 0.1%
  • Veröffentlicht 22.06.2024 12:15:09
  • Zuletzt bearbeitet 21.11.2024 09:49:16

A vulnerability, which was classified as problematic, was found in playSMS 1.4.3. Affected is an unknown function of the file /index.php?app=main&inc=feature_phonebook&op=phonebook_list of the component New Phonebook Handler. The manipulation of the ...

9.8

CVE-2022-47034

  • EPSS 0.49%
  • Veröffentlicht 13.02.2023 22:15:13
  • Zuletzt bearbeitet 21.03.2025 19:15:40

A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.

9.8

CVE-2021-40373

Exploit
  • EPSS 25.49%
  • Veröffentlicht 10.09.2021 14:15:12
  • Zuletzt bearbeitet 21.11.2024 06:23:58

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executing that code via the index.php?app=main&inc=core_welcome URI.

6.5

CVE-2020-15018

Exploit
  • EPSS 0.2%
  • Veröffentlicht 24.06.2020 13:15:11
  • Zuletzt bearbeitet 21.11.2024 05:04:38

playSMS through 1.4.3 is vulnerable to session fixation.

9.8

CVE-2020-8644

Warnung Exploit
  • EPSS 94%
  • Veröffentlicht 05.02.2020 22:15:11
  • Zuletzt bearbeitet 07.11.2025 22:04:10

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

9.8

CVE-2017-9101

Exploit
  • EPSS 80.05%
  • Veröffentlicht 21.05.2017 18:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.

8.8

CVE-2017-9080

Exploit
  • EPSS 73.45%
  • Veröffentlicht 19.05.2017 15:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.