---
id: "CVE-2020-37284"
kind: "vulnerability"
aliases: ["CVE-2020-37284"]
title: "Sickbeard: reflected XSS in testNaming page runs scripts in browsers"
severity: "medium"
cvss: 6.1
epss: 0.00205
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "sickbeard", "web"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-22T11:17:04+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:02:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37284", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-37284", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Sickbeard: reflected XSS in testNaming page runs scripts in browsers

Sickbeard through build-507 returns the pattern parameter of /config/postProcessing/testNaming unescaped, so a crafted GET link with an SVG onload payload runs JavaScript in the victim's browser. An attacker needs no account and only has to get a user to open the link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether a Sickbeard instance is running and what build it is, using the build number in the application's about or version page.
- Confirm whether the instance is reachable from the internet or untrusted networks.

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-37284
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-37284

## From the sources

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_