{"id":"CVE-2012-5878","aliases":["EUVD-2012-5756","GHSA-vm48-9jq9-p4rm"],"status":"published","title":"Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to...","description":"Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09296,"percentile":0.95403,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2020-01-03T19:30:28Z","modified":"2026-06-16T23:47:30Z","exploits":[{"source":"exploitdb","id":"EDB-38114","title":"Smartphone Pentest Framework - Multiple Remote Command Execution Vulnerabilities","type":"webapps","platform":"cgi","date":"2012-12-10","verified":true,"url":"https://www.exploit-db.com/exploits/38114"}],"products":[{"vendor":"bulbsecurity","product":"smartphone_pentest_framework"}],"references":[{"url":"https://www.htbridge.com/advisory/HTB23123","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory"]},{"url":"https://www.htbridge.com/advisory/HTB23127","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5878"},{"url":"https://github.com/advisories/GHSA-vm48-9jq9-p4rm"}],"sources":{"cve":[{"id":"CVE-2012-5878","description":"Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.","status":"published","published":"2020-01-03T19:30:28Z","modified":"2024-08-06T21:21:28.024Z","updated_at":"2026-11-02T14:34:49.246229Z"}],"euvd":[{"id":"EUVD-2012-5756","description":"Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.","status":"published","published":"2020-01-03T19:30:28Z","modified":"2024-08-06T21:21:28Z","updated_at":"2026-11-03T01:56:03.550057Z"}],"ghsa":[{"id":"GHSA-vm48-9jq9-p4rm","title":"Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to...","description":"Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.","status":"published","published":"2022-04-23T00:40:28Z","modified":"2023-01-27T05:02:14Z","updated_at":"2026-11-02T14:42:02.011098Z"}],"nvd":[{"id":"CVE-2012-5878","description":"Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to (1) SEAttack.pl or (2) CSAttack.pl in frameworkgui/ or the (3) appURLPath parameter to frameworkgui/attachMobileModem.pl.","status":"published","published":"2020-01-03T20:15:11.027Z","modified":"2026-06-16T23:47:30.377Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:02:18.043773Z"}]}}