CVE-2020-37173CWE-359

AVideo Platform 8.1 - Information Disclosure (User Enumeration)

High · published February 11, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
50.8
In the wild
Unconfirmed
What it is

AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00656 · 50.8th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2026-02-11T20:36Z
EPSS history
Timeline
  • 11 FEB 20:36Z
    AVideo Platform 8.1 - Information Disclosure (User Enumeration)
    cvelistv5