CVE-2020-37192 MSN Password Recovery 1.30 - XML External Entity Injection
Attackers can read local system files via XML external entity injection in MSN Password Recovery, exposing sensitive configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-37192?
CVE-2020-37192 is a medium-severity vulnerability in Top Password Software MSN Password Recovery, published on 11 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that references external entities to retrieve sensitive system configuration information.
Weakness: CWE-611
Which versions are affected by CVE-2020-37192?
How do I fix CVE-2020-37192?
No fix has been published for CVE-2020-37192 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-37192 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37192 exists.
Sources
Also known as GHSA-975r-cfgj-8mhf.