CVE-2020-37173
AVideo Platform 8.1 - Information Disclosure (User Enumeration)
- State
- Published
- Severity
- 8.7 High
- Published
- Feb 11, 2026
- Updated
- Oct 1, 2026
- Reserved
- Feb 10, 2026
Description
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
AVideo PlatformAVideo |
|
References
- ExploitDB-47997exploit
- Official AVideo Platform Homepageproduct
- AVideo Platform GitHub Repositoryproduct
- VulnCheck Advisory: AVideo Platform 8.1 - Information Disclosure (User Enumeration)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.