CVE-2020-37172CWE-640

AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

High · published February 11, 2026

CVSS v4.0
8.5
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00761 · 54.8th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-02-11T20:33Z
EPSS history
Timeline
  • 11 FEB 20:33Z
    AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
    cvelistv5