Vulnerability · Published Feb 3, 2026 · Assigned by VulnCheck

CVE-2020-37087Easy Transfer 1.7 for iOS - Persistent Cross-Site Scripting

Medium 5.1

In plain English

A medium-severity cross-site scripting in Easy Transfer from Rubikon Teknoloji. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts by manipulating the oldPath, newPath, and path parameters in Create Folder and Move/Edit functions. Attackers can exploit improper input validation via POST requests to execute arbitrary JavaScript in the context of the mobile web application.

Affected products (as reported)

Vendor	Product	Versions
Rubikon Teknoloji	Easy Transfer	1.7

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

ExploitDB-48395 exploit, technical-description
Vulnerability-Lab Advisory technical-description, exploit
Official App Store Product Page product
VulnCheck Advisory: Easy Transfer 1.7 for iOS - Persistent Cross-Site Scripting third-party-advisory