CVE-2020-14022

PoC —

CVSS 3.1

8.8 high

EPSS

2%p78

Published

Sep 22, 2020 (Sep 22, 2020)

Modified

Jun 17, 2026

Description

Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Starter" module) within the application.

Vendors: ozeki
Products: ozeki ng sms gateway
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.8%)

In the news0 stories

No ingested article mentions this CVE yet.