CVE-2020-8644

PlaySMS suffered a server-side template injection vulnerability allowing remote code execution.

The PlaySMS server contained a server-side template injection flaw that permitted remote code execution, enabling attackers to execute arbitrary commands on the system. This failure is critical for DIB organizations because it represents an unpatched, actively exploited vulnerability (KEV) that could lead to system compromise, data exfiltration, or ransomware deployment. Organizations must ensure all communication and messaging platforms are patched against known CVEs and monitored for exploitation in the wild.

Shame score — The vulnerability was actively exploited in the wild (KEV) and allowed remote code execution, indicating a severe, avoidable failure to patch known security flaws.