CVE-2020-37173

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Exposure of Private Personal Information to an Unauthorized Actor pada wwbn avideo. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.

Rincian

Terbit di NVD

11 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/47997 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/avideo-platform-information-disclosure-user-enumeration advisory pihak ketiga
• https://avideo.com product
• https://github.com/WWBN/AVideo product