What’s Vulnerable › Vulnerabilities

CVE-2017-20219: Serviio PRO 1.8 DOM-based Cross-Site Scripting via mediabrowser

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-79

Description

Serviio PRO 1.8 DLNA Media Streaming Server contains a DOM-based cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads. Attackers can craft URLs with malicious input that is read from document.location and passed to document.write() in the mediabrowser component to execute code in a user's browser context.

Affected products

• Serviio PRO: 1.8.0.0 PRO, 1.7.1, 1.7.0, 1.6.1

References

• https://blogs.securiteam.com/index.php/archives/3094
• https://cxsecurity.com/issue/WLB-2017050020
• https://exchange.xforce.ibmcloud.com/vulnerabilities/125647
• https://packetstormsecurity.com/files/142385
• https://www.vulncheck.com/advisories/serviio-pro-dom-based-cross-site-scripting-via-mediabrowser
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5406.php

Get alerted when CVE-2017-20219 or the next vulnerability affects your stack