CVE-2020-37027

critical · 9.3

Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extra scripts configuration. Attackers can set malicious commands in the extra scripts field and trigger processing to execute remote code on the vulnerable Sickbeard installation.

9.3

CVSS

2.4%

EPSS (exploit prob.)

83rd

EPSS percentile

2026-01-30

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

References

https://github.com/midgetspy/Sick-Beard
https://web.archive.org/web/20190722085652/https://sickbeard.com/
https://www.exploit-db.com/exploits/48646
https://www.vulncheck.com/advisories/sickbeard-remote-command-injection

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-37027