Home

Description

MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.

PUBLISHED Reserved 2026-02-10 | Published 2026-02-11 | Updated 2026-02-12 | Assigner VulnCheck




MEDIUM: 6.7CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
MEDIUM: 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Improper Restriction of XML External Entity Reference

Product status

1.30
affected

Credits

ZwX finder

References

www.exploit-db.com/exploits/47896 (ExploitDB-47896) exploit

www.top-password.com/ (Vendor Homepage) product

www.vulncheck.com/...-recovery-xml-external-entity-injection (VulnCheck Advisory: MSN Password Recovery 1.30 - XML External Entity Injection) third-party-advisory

cve.org (CVE-2020-37192)

nvd.nist.gov (CVE-2020-37192)

Download JSON