PlaySMS Server-Side Template Injection Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2020-8644 · Published 05/02/2020 · updated 17/06/2026

PlaySMS Server-Side Template Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
playsms playsms	`< 1.4.3`	`1.4.3`

Description

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

References

packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html · Exploit
forum.playsms.org/t/playsms-1-4-3-has-been-released/2704 · Broken Link
playsms.org/2020/02/05/playsms-1-4-3-has-been-released · Vendor Advisory
research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644 · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-8644

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free