Critical severity · published Feb 11, 2026
CVE-2020-37172
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
AVideo Platform · AVideo
8.1 · source: vendor
AV
Avideo · Wwbn
8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37172
exploit
https://www.exploit-db.com/exploits/48003
product
https://avideo.com
product
https://github.com/WWBN/AVideo
third-party-advisory
https://www.vulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-reset
More from AVideo Platform
8.8
CVE-2020-37158
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
7.5
CVE-2020-37173
AVideo Platform 8.1 - Information Disclosure (User Enumeration)