CVE-2020-37173

AVideo Platform 8.1 - Information Disclosure (User Enumeration)

AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.

Affected

AVideo · AVideo Platform

CVSS v4.0 VULNCHECK

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.66% chance of exploitation in the next 30 days, 50th percentile

Published

2026-02-11

Updated

2026-10-01

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/47997

Security advisories

• https://www.vulncheck.com/advisories/avideo-platform-information-disclosure-user-enumerat…
• https://avideo.com
• WWBN/AVideo

References

• CVE Record
• NVD entry