CVE-2020-5223mediumCWE-79

CVE-2020-5223: falha de média gravidade em PrivateBin

Persistent XSS vulnerability in filename of attached file in PrivateBin

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar PrivateBin+ Monitorar privatebin/privatebin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.7%
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 & v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Produtos afetados
PrivateBin · PrivateBin
CVEs relacionadas — PrivateBin

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24833HIGHPersistent Cross-site Scripting (XSS) vulnerability in PrivateBinEPSS 1.4%CVE-2024-39899MEDIUMPrivateBin allows shortening of URLs for other domainsEPSS 0.6%CVE-2026-55891NONEPrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URIEPSS 0.5%CVE-2025-64714MEDIUMPrivateBin's template-switching feature allows arbitrary local file inclusion through path traversalEPSS 0.5%CVE-2026-55696MEDIUMPrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interactionEPSS 0.4%CVE-2025-62796MEDIUMPrivateBin persistent HTML injection in attachment filename enables redirect and defacementEPSS 0.3%