{"id":"CVE-2020-37284","kind":"vulnerability","aliases":["CVE-2020-37284"],"related":[],"title":"Sickbeard: reflected XSS in testNaming page runs scripts in browsers","description":"Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.","summary":"Sickbeard through build-507 returns the pattern parameter of /config/postProcessing/testNaming unescaped, so a crafted GET link with an SVG onload payload runs JavaScript in the victim's browser. An attacker needs no account and only has to get a user to open the link.","severity":"medium","cvss":6.1,"epss":0.00205,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","sickbeard","web"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check whether a Sickbeard instance is running and what build it is, using the build number in the application's about or version page.\n- Confirm whether the instance is reachable from the internet or untrusted networks.","fix":"- unknown","status":"open","published_at":"2026-10-22T11:17:04+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:02:13+00:00","updated_at":"2026-10-25T04:02:13+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:02:13Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Sickbeard: reflected XSS in testNaming page runs scripts in browsers","impact":"medium","summary":"Sickbeard through build-507 returns the pattern parameter of /config/postProcessing/testNaming unescaped, so a crafted GET link with an SVG onload payload runs JavaScript in the victim's browser. An attacker needs no account and only has to get a user to open the link.","category":"other","nicknames":[],"who_cares":["sickbeard","self-hosted","web"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs JavaScript in a victim's logged-in browser session","analyst_note":"","how_to_check":"- Check whether a Sickbeard instance is running and what build it is, using the build number in the application's about or version page.\n- Confirm whether the instance is reachable from the internet or untrusted networks.","needs_analyst":false,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams running Sickbeard build-507 or earlier, most likely as a self-hosted media automation tool. The flaw needs a user to open a crafted link, so exposure depends on whether the instance is reachable by people who would click such a link. unknown whether a newer build fixes it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000581,"input_tokens":3415,"output_tokens":479,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10':124C '-2020':12A,15A '-22':125C '-37284':13A,16A '-507':26B,70C '/config/postprocessing/testnaming':32B,91C '2023':123C 'account':55B 'allow':80C 'attack':52B,82C,92C 'browser':10A,50B,112C 'build':25B,69C 'contain':71C 'craft':36B,94C 'cross':75C 'cross-sit':74C 'cve':11A,14A 'evid':114C 'execut':108C 'exploit':113C 'first':116C 'foundat':121C 'get':37B,60B,95C 'handler':105C 'host':20B 'inject':84C 'javascript':45B,109C 'link':38B,66B 'malici':98C 'need':53B 'observ':117C 'onload':42B,100C 'open':64B 'page':6A 'paramet':30B,89C 'pattern':29B,88C 'payload':43B,101C 'reflect':2A,73C 'request':96C 'return':27B,106C 'run':7A,44B 'script':8A,77C,85C 'self':19B 'self-host':18B 'shadowserv':120C 'sickbeard':1A,21B,23B,67C 'site':76C 'svg':41B,99C 'testnam':5A,104C 'unauthent':81C 'unescap':33B,107C 'user':62B 'victim':48B,111C 'vulner':78C 'web':22B 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Teams running Sickbeard build-507 or earlier, most likely as a self-hosted media automation tool. The flaw needs a user to open a crafted link, so exposure depends on whether the instance is reachable by people who would click such a link. unknown whether a newer build fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2020-37284","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37284","severity":null,"published_at":"2026-10-22T11:17:04+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2020-37284","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37284","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}