PT-2026-7660 · Avideo+2 · Avideo Platform+1

Ihsan Sencan · CVE-2020-37172 · Published 2026-02-11 · Updated 2026-02-18

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo Platform version 8.1

Description The software contains a cross-site request forgery condition that permits attackers to reset user passwords. This is achieved by exploiting the password recovery mechanism, where attackers can construct malicious requests to the /recoverPass API endpoint. Utilizing a user's recovery token, attackers can alter account credentials without proper authentication.

Recommendations Apply updates to address the issue in AVideo Platform version 8.1.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2020-37172

Affected Products

Avideo Platform

Avideo

References · 7

• 🔥 https://exploit-db.com/exploits/48003 · Exploit
• https://osv.dev/vulnerability/CVE-2020-37172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-37172 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://t.me/cveNotify/152413 · Telegram Post
• https://vulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-reset · Note
• https://avideo.com · Note