CVE-2020-5741

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
n/aPlex Media Server (Windows)Versions prior to 1.19.3

References

Timeline

Published
May 8, 2020
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 10, 2023
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-57428.8Improper Access Control in Plex Media Server prior to June 15, 2020 allows any origin to execute cross-origin application requests.CVE-2020-57434.3Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they donCVE-2020-57444.9Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk.CVE-2020-57457.4Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users iCVE-2020-57465.4Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) aCVE-2020-57475.4Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) aCVE-2020-57486.1Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS)CVE-2020-57495.4Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) aCVE-2020-57506.1Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS)CVE-2020-57515.4Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) aCVE-2020-57527.8Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system CVE-2020-57535.3Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disc
CVE-2020-5741: High severity, CVSS 7.2 | Vulnix