PDW File Browser GitHub Repositoryproduct
https://github.com/GuidoNeele/PDW-File-Browser CVE-2020-36988
MEDIUM
PDW File Browser <= v1.3 - Cross-Site Scripting (XSS)
Record summary
CVE-2020-36988 has a selected CVSS score of 4.8 (medium); EIP currently links 1 catalogued exploit.
Description
PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through file rename and path parameters. Attackers can craft malicious URLs or rename files with XSS payloads to execute arbitrary JavaScript in victims' browsers when they access the file browser.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 28, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
PDW File BrowserBrowse GuidoNeele / PDW File Browser | CVE List | Through 1.3 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBPDW File Browser 1.3 - 'new_filename' Cross-Site Scripting (XSS)ExploitDB exploitby David BimmelNot analyzed1 file
References
4nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-36988 ExploitDB-48947exploit
https://www.exploit-db.com/exploits/48947 VulnCheck Advisory: PDW File Browser <= v1.3 - Cross-Site Scripting (XSS)Third-party advisory
https://www.vulncheck.com/advisories/pdw-file-browser-cross-site-scripting-xss