CVE-2020-37173 AVideo Platform 8.1 - Information Disclosure (User Enumeration)
Attackers can enumerate user details including emails and password hashes via the playlistsFromUser.json.php endpoint in AVideo Platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37173?
CVE-2020-37173 is a high-severity vulnerability in Wwbn Avideo, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
Weakness: CWE-359
Which versions are affected by CVE-2020-37173?
It affects 1 product.
Products include Wwbn Avideo.
How do I fix CVE-2020-37173?
No fix has been published for CVE-2020-37173 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-37173 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37173 exists.
Other vulnerabilities in Wwbn Avideo
- CVE-2026-40911 WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
- CVE-2026-33478 AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
- CVE-2022-30534 Command injection in AVideo
- CVE-2022-30547 Path traversal in AVideo
- CVE-2022-32572 Command injection in AVideo
Sources
Also known as GHSA-349p-7f27-qvx8.