Vulnerability · Published Feb 11, 2026 · Assigned by VulnCheck
CVE-2020-37173AVideo Platform 8.1 - Information Disclosure (User Enumeration)
High 7.5
In plain English
A high-severity security flaw in AVideo Platform from AVideo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 48.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AVideo | AVideo Platform | 8.1 |
Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-47997 exploit
- Official AVideo Platform Homepage product
- AVideo Platform GitHub Repository product
- VulnCheck Advisory: AVideo Platform 8.1 - Information Disclosure (User Enumeration) third-party-advisory