Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2020-37284Sickbeard build-507 Reflected XSS via testNaming pattern Parameter

Medium 6.1

In plain English

A medium-severity cross-site scripting in Sickbeard from midgetspy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.

Affected products (as reported)

Vendor	Product	Versions
midgetspy	Sickbeard	0 – through build-507

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Nuclei Template technical-description
VulnCheck Advisory: Sickbeard build-507 Reflected XSS via testNaming pattern Parameter third-party-advisory