High severity · published Feb 11, 2026
CVE-2020-37173
AVideo Platform 8.1 - Information Disclosure (User Enumeration)
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
AVideo Platform · AVideo
8.1 · source: vendor
AV
Avideo · Wwbn
8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37173
exploit
https://www.exploit-db.com/exploits/47997
product
https://avideo.com
product
https://github.com/WWBN/AVideo
third-party-advisory
https://www.vulncheck.com/advisories/avideo-platform-information-disclosure-user-enumeration
More from AVideo Platform
9.8
CVE-2020-37172
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
8.8
CVE-2020-37158
AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)