Medium severity · published Oct 22, 2026
CVE-2020-37284
Sickbeard build-507 Reflected XSS via testNaming pattern Parameter
New
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Sickbeard · midgetspy
through build-507 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37284
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37284
github.com
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/sick-beard-xss.yaml
www.vulncheck.com
https://www.vulncheck.com/advisories/sickbeard-build-507-reflected-xss-via-testnaming-pattern-parameter
More from Sickbeard
9.8
CVE-2020-37027
Sickbeard 0.1 - Remote Command Injection
5.3
CVE-2020-37026
Sickbeard 0.1 - Cross-Site Request Forgery