CVE-2024-8880

A vulnerability classified as critical has been found in playSMS 1.4.4/1.4.5/1.4.6/1.4.7. Affected is an unknown function of the file /playsms/index.php?app=main&inc=core_auth&route=forgot&op=forgot of the component Template Handler. The manipulation of the argument username/email/captcha leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The project maintainer was informed early about the issue. Investigation shows that playSMS up to 1.4.3 contained a fix but later versions re-introduced the flaw. As long as the latest version of the playsms/tpl package is used, the software is not affected. Version >=1.4.4 shall fix this issue for sure.

• CWE-94

• https://vuldb.com/?ctiid.277524Permissions Required
• https://vuldb.com/?id.277524Third Party Advisory
• https://vuldb.com/?submit.406095Exploit, Third Party Advisory

Published

Sep 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8873The PeproDev WooCommerce Receipt Uploader plugin for WordPre…6.1
• CVE-2024-8874The AJAX Login and Registration modal popup + inline form pl…6.1
• CVE-2024-8875A vulnerability classified as critical was found in vedees w…9.1
• CVE-2024-8876A vulnerability, which was classified as problematic, has be…7.5
• CVE-2024-8877Improper neutralization of special elements results in a SQL…9.8
• CVE-2024-8878The password recovery mechanism for the forgotten password i…9.8
• CVE-2024-8881A post-authentication command injection vulnerability in the…6.8
• CVE-2024-8882A buffer overflow vulnerability in the CGI program in the Zy…4.5
• CVE-2024-8883A misconfiguration flaw was found in Keycloak. This issue ca…6.1
• CVE-2024-8884CWE-200: Exposure of Sensitive Information to an Unauthorize…9.8
• CVE-2024-8885A local privilege escalation vulnerability in Sophos Interce…8.8
• CVE-2024-8887CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affec…8.6