CVE-2020-37172
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
- State
- Published
- Severity
- 8.5 High
- Published
- Feb 11, 2026
- Updated
- Oct 1, 2026
- Reserved
- Feb 10, 2026
Description
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected Products
| Product | Versions |
|---|---|
AVideo PlatformAVideo |
|
References
- ExploitDB-48003exploit
- Official AVideo Platform Homepageproduct
- AVideo GitHub Repositoryproduct
- VulnCheck Advisory: AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.