CVE-2020-37123

9.3 criticalEPSS 3.4%

Critical (9.3). EPSS 3.4% chance of exploitation in the next 30 days.

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-02-05
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/wcchandler/pinger
https://www.exploit-db.com/exploits/48323
https://www.vulncheck.com/advisories/pinger-remote-code-execution

Check your stack JSON