Medium severity · published Feb 3, 2026
CVE-2020-37087
Easy Transfer 1.7 for iOS - Persistent Cross-Site Scripting
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts by manipulating the oldPath, newPath, and path parameters in Create Folder and Move/Edit functions. Attackers can exploit improper input validation via POST requests to execute arbitrary JavaScript in the context of the mobile web application.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
Easy Transfer · Rubikon Teknoloji
1.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37087
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37087
apps.apple.com
https://apps.apple.com/us/app/easy-transfer-wifi-transfer/id1484667078
www.exploit-db.com
https://www.exploit-db.com/exploits/48395
www.vulncheck.com
https://www.vulncheck.com/advisories/easy-transfer-for-ios-persistent-cross-site-scripting
www.vulnerability-lab.com
https://www.vulnerability-lab.com/get_content.php?id=2223
More from Easy Transfer
6.2
CVE-2020-37086
Easy Transfer 1.7 for iOS - Directory Traversal