CVE-2020-37158

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.

Affected

AVideo · AVideo Platform

CVSS v4.0 VULNCHECK

8.5 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1 VULNCHECK

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 18th percentile

Published

2026-02-11

Updated

2026-10-01

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/48003

Security advisories

• https://www.vulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-…
• https://avideo.com
• WWBN/AVideo

References

• CVE Record
• NVD entry