PT-2026-7672 · Avideo+2 · Avideo Platform+1

Ihsan Sencan · Published 2026-02-11 · Updated 2026-02-18 · CVE-2020-37173

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo Platform version 8.1

Description An information disclosure issue exists in AVideo Platform version 8.1. This allows attackers to enumerate user details. The issue is present in the playlistsFromUser.json.php API endpoint. By manipulating the users id parameter, attackers can retrieve sensitive user information, including email addresses, password hashes, and administrative status.

Recommendations Apply any available updates to address this vulnerability. As a temporary workaround, restrict access to the playlistsFromUser.json.php endpoint. Consider implementing stricter input validation for the users id parameter.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2020-37173

Affected Products

Avideo Platform

Avideo

References · 7

• 🔥 https://exploit-db.com/exploits/47997 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37173 · Security Note
• https://osv.dev/vulnerability/CVE-2020-37173 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://avideo.com · Note
• https://vulncheck.com/advisories/avideo-platform-information-disclosure-user-enumeration · Note
• https://t.me/cveNotify/152414 · Telegram Post