AVideo AVideo Platform vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting AVideo AVideo Platform: 3 record(s), with affected versions and fixes.
CVE-2020-37173
High · 7.5
CWE-359 Feb 11, 2026
AVideo Platform 8.1 - Information Disclosure (User Enumeration)
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
CVE-2020-37172
Critical · 9.8
CWE-640 Feb 11, 2026
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
CVE-2020-37158
High · 8.8
CWE-352 Feb 11, 2026
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.