CVE-2020-37123

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

CVSS v4.0

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.14% chance of exploitation in the next 30 days, 87th percentile

Nuclei

critical · CWE-78

Published

2026-02-05

Updated

2026-02-06

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48323

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-37123.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2020-37122
• CVE-2020-37124
• CVE-2020-37121
• CVE-2020-37125
• CVE-2020-37120
• CVE-2020-37126