CVE-2020-5223mediumCWE-79

CVE-2020-5223: fallo de gravedad media en PrivateBin

Persistent XSS vulnerability in filename of attached file in PrivateBin

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear PrivateBin+ Monitorear privatebin/privatebin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.7%
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Productos afectados
PrivateBin · PrivateBin
CVEs relacionadas — PrivateBin

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-24833HIGHPersistent Cross-site Scripting (XSS) vulnerability in PrivateBinEPSS 1.4%CVE-2024-39899MEDIUMPrivateBin allows shortening of URLs for other domainsEPSS 0.6%CVE-2026-55891NONEPrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URIEPSS 0.5%CVE-2025-64714MEDIUMPrivateBin's template-switching feature allows arbitrary local file inclusion through path traversalEPSS 0.5%CVE-2026-55696MEDIUMPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactionEPSS 0.4%CVE-2025-62796MEDIUMPrivateBin persistent HTML injection in attachment filename enables redirect and defacementEPSS 0.3%