VULNERABILITY INTELLIGENCE
CVE-2020-37192
CVSS score6.2 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-02-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.
Weakness classification
- disclosure@vulncheck.com: CWE-611