Avideo Platform vulnerabilities
3 known vulnerabilities affecting avideo/avideo_platform.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH3
Vulnerabilities
Page 1 of 1
CVE-2020-37158HIGHCVSS 8.5v8.12026-02-11
CVE-2020-37158 [HIGH] CWE-352 CVE-2020-37158: AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to res
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
nvd
CVE-2020-37172HIGHCVSS 8.5v8.12026-02-11
CVE-2020-37172 [HIGH] CWE-640 CVE-2020-37172: AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to res
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
nvd
CVE-2020-37173HIGHCVSS 8.7v8.12026-02-11
CVE-2020-37173 [HIGH] CWE-359 CVE-2020-37173: AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumer
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
nvd