CVE-2020-37071Disclosure

MEDIUMCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. Attackers can generate a malicious serialized payload that triggers remote code execution by exploiting the plugin's vCard download functionality with a specially crafted request.

Back to dashboard

5.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
3 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked at 2 mentions on most recent observed day (2026-02-04)
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

Active Exploitation

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-03	1	Disclosure1
2026-02-04	2	Active Exploitation1Disclosure1

Full discourse3 posts

CVE@CVEnew246d
Disclosure
CVE-2020-37071 CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary PHP code through a crafted payload. … https://www.cve.org/CVERecord?id=CVE-2020-37071
Post summary
CVE-2020-37071 is a deserialization flaw in CraftCMS 3 vCard Plugin 1.0.0 that permits unauthenticated attackers to run arbitrary PHP code via a crafted payload, yet no PoC, exploit code, or patch information is provided.
00010209
56.5K followersView on X
CVEFind.com@CveFindCom246d
Active Exploitation
[CVE-2020-37071: CRITICAL] CraftCMS 3 vCard Plugin 1.0.0 has a deserialization vulnerability letting attackers execute PHP code via crafted payload. Exploited in vCard download feature for remote code execut...#cve,CVE-2020-37071,#cybersecurity https://cvefind.com/CVE-2020-37071
Post summary
CraftCMS v3 vCard Plugin 1.0.0 has a critical deserialization flaw that has been actively exploited to achieve remote PHP code execution via its download feature.
00000104
583 followersView on X
0day Signal@0dayPublishing246d
Disclosure
🚨 CVE-2020-37071: CraftCMS 3 vCard Plugin 1.0.0 - ... Unauthenticated PHP deserialization in CraftCMS vCard 1.0.0 equals game over - trivial RCE through crafted download req... https://zerodaysignal.com/vulnerability/CVE-2020-37071 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet discloses CVE-2020-37071, detailing an unauthenticated PHP deserialization flaw in CraftCMS vCard 1.0.0 that allows trivial remote code execution, and links to a zero-day signal page for more information.
0000090
132 followersView on X

Explore more

Back to dashboard