CVE-2020-8644
PlaySMS Server-Side Template Injection Vulnerability
Published Feb 5, 2020 · updated Jun 16, 2026 · playsms playsms
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
Timeline
Detection, updates, and resolution for this record.
Feb 5, 2020 · Catalog
Detected
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe playsms/playsmsversion unspecified
- vendor PlaySMS PlaySMSversion unspecified
Sources
- CISA KEVCVE-2020-8644
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
cisa.gov - CVE.orgCVE-2020-8644
Official CVE identifier
cve.org - FIRST EPSSCVE-2020-8644
30-day exploitation probability 86.7%
first.org - Exploit Database48335
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/playsms_template_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2020-8644
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com