PT-2026-7672
CVE-2020-37173
·
Published
2026-02-11
·
Updated
2026-02-18
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
AVideo Platform version 8.1
Description
An information disclosure issue exists in AVideo Platform version 8.1. This allows attackers to enumerate user details. The issue is present in the
playlistsFromUser.json.php API endpoint. By manipulating the users id parameter, attackers can retrieve sensitive user information, including email addresses, password hashes, and administrative status.Recommendations
Apply any available updates to address this vulnerability. As a temporary workaround, restrict access to the
playlistsFromUser.json.php endpoint. Consider implementing stricter input validation for the users id parameter. Found an issue in the description? Have something to add? Feel free to write us 👾