pppscn SmsForwarder vulnerabilities

Latest pppscn SmsForwarder CVEs

Newest publication first

1. CVE-2026-110618 SmsForwarder through 3.5.0 Missing Authentication in HTTP Server Remote Control API

   Published 2026-10-14

   High·CVSS 8.6 EPSS 0.39%

   SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.