locutus records
8 published records for vendor locutus.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 3
- With a fix record
- 87.5%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')4
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
8 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
40Plan | CVE-2020-13619No exploit | php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.locutus · locutus php · CWE-78 | Critical9.8 | 2.9%Jul 1, 2020 |
40Plan | CVE-2020-7719No exploit | Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.locutus · locutus · CWE-1321 | Critical9.8 | 2.7%Sep 1, 2020 |
39Monitor | CVE-2026-32304No exploit | Locutus: RCE via unsanitized input in create_function()locutus · locutus · CWE-94 | Critical9.8 | 0.6%Mar 13, 2026 |
37Monitor | CVE-2026-25521No exploit | Locutus is vulnerable to Prototype Pollutionlocutus · locutus · CWE-1321 | Critical9.4 | 0.3%Feb 4, 2026 |
32Monitor | CVE-2026-29091No exploit | Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injectionlocutus · locutus · CWE-95 | High8.1 | 0.8%Mar 6, 2026 |
31Monitor | CVE-2021-23392No exploit | Regular Expression Denial of Service (ReDoS)locutus · locutus | High7.5 | 1.9%Jun 8, 2021 |
27Monitor | CVE-2026-33993No exploit | Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()locutus · locutus · CWE-1321 | Medium6.9 | 0.5%Mar 27, 2026 |
25Monitor | CVE-2026-33994No exploit | Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521locutus · locutus · CWE-1321 | Medium6.3 | 0.5%Mar 27, 2026 |
- CVE-2020-1361940Plan
php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
CriticalCVSS 9.8No exploitEPSS 2%locutus · locutus phpJul 1, 2020
- CVE-2020-771940Plan
Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.
CriticalCVSS 9.8No exploitEPSS 2%locutus · locutusSep 1, 2020
- CVE-2026-3230439Monitor
Locutus: RCE via unsanitized input in create_function()
CriticalCVSS 9.8No exploitEPSS 0%locutus · locutusMar 13, 2026
- CVE-2026-2552137Monitor
Locutus is vulnerable to Prototype Pollution
CriticalCVSS 9.4No exploitEPSS 0%locutus · locutusFeb 4, 2026
- CVE-2026-2909132Monitor
Locutus: Remote Code Execution (RCE) in locutus call_user_func_array due to Code Injection
HighCVSS 8.1No exploitEPSS 0%locutus · locutusMar 6, 2026
- CVE-2021-2339231Monitor
Regular Expression Denial of Service (ReDoS)
HighCVSS 7.5No exploitEPSS 1%locutus · locutusJun 8, 2021
- CVE-2026-3399327Monitor
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
MediumCVSS 6.9No exploitEPSS 0%locutus · locutusMar 27, 2026
- CVE-2026-3399425Monitor
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
MediumCVSS 6.3No exploitEPSS 0%locutus · locutusMar 27, 2026