What’s Vulnerable › Vulnerabilities

CVE-2020-37059: Popcorn Time 6.2 - 'Update service' Unquoted Service Path

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-30 · updated 2026-06-17
• Weakness: CWE-428

Description

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files (x86) or system root directories to be executed with SYSTEM-level permissions during service startup.

Affected products

• Getpopcorntime Popcorn Time: 6.2.1.14

References

• https://getpopcorntime.is
• https://www.exploit-db.com/exploits/48378
• https://www.vulncheck.com/advisories/popcorn-time-update-service-unquoted-service-path

Get alerted when CVE-2020-37059 or the next vulnerability affects your stack