Vulnerability · Published Feb 5, 2026 · Assigned by VulnCheck
CVE-2020-37123Pinger 1.0 - Remote Code Execution
Critical 9.8
In plain English
A critical-severity OS command injection in Pinger from wcchandler. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.3%top 11.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wcchandler | Pinger | 1.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-48323 exploit
- Pinger GitHub Repository product
- VulnCheck Advisory: Pinger 1.0 - Remote Code Execution third-party-advisory