CVEvulnerability
CVE-2020-37173
8.7 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-359
Description
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
Affected configurations
• wwbn avideo 8.1
Related
Weakness · CWE (1)
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness
References
- https://avideo.com Product
- https://github.com/WWBN/AVideo Product
- https://www.exploit-db.com/exploits/47997 Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/avideo-platform-information-disclosure-user-enumeration Third Party Advisory