What’s Vulnerable › Vulnerabilities

CVE-2017-9080

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 62.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-05-19 · updated 2026-06-17
• Weakness: CWE-434

Description

PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.

Affected products

• playSMS: 1.4

References

• http://touhidshaikh.com/blog/poc/playsms-v1-4-rce/
• https://www.exploit-db.com/exploits/42003/
• https://www.exploit-db.com/exploits/44599/
• http://touhidshaikh.com/blog/poc/playsms-v1-4-rce/
• https://www.exploit-db.com/exploits/42003/
• https://www.exploit-db.com/exploits/44599/

Get alerted when CVE-2017-9080 or the next vulnerability affects your stack