Live › vulnerability › CVE-2020-37284
Go to dashboardSickbeard through build-507 returns the pattern parameter of /config/postProcessing/testNaming unescaped, so a crafted GET link with an SVG onload payload runs JavaScript in the victim's browser. An attacker needs no account and only has to get a user to open the link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Sickbeard build-507 or earlier, most likely as a self-hosted media automation tool. The flaw needs a user to open a crafted link, so exposure depends on whether the instance is reachable by people who would click such a link. unknown whether a newer build fixes it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
This page as .md · .json · in your agent: get_signal("CVE-2020-37284")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.