CVE-2020-37123

Pinger 1.0 - Remote Code Execution

CVSS 9.3 CRITICALEPSS 3.1%CWE-78

Vexday Risk Score

63High priority

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 3.1%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

05 Feb 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

wcchandler · Pinger

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/48323unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/wcchandler/pinger https://www.exploit-db.com/exploits/48323 https://www.vulncheck.com/advisories/pinger-remote-code-execution