CVE-2020-37123

critical · 9.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

9.3

CVSS

3.1%

EPSS (exploit prob.)

87th

EPSS percentile

2026-02-05

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

References

https://github.com/wcchandler/pinger
https://www.exploit-db.com/exploits/48323
https://www.vulncheck.com/advisories/pinger-remote-code-execution

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-37123