What’s Vulnerable › Vulnerabilities

CVE-2020-37172: AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-11 · updated 2026-06-17
• Weakness: CWE-640

Description

AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.

Affected products

• WWBN AVideo: 8.1

References

• https://avideo.com
• https://github.com/WWBN/AVideo
• https://www.exploit-db.com/exploits/48003
• https://www.vulncheck.com/advisories/avideo-platform-cross-site-request-forgery-password-reset

Get alerted when CVE-2020-37172 or the next vulnerability affects your stack