What is the CVSS score of CVE-2020-37173?

CVE-2020-37173 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2020-37173?

Avideo installations up to version 8.1 contain a vulnerability allowing attackers to extract user information without authorization.

Is there a public PoC exploit available for CVE-2020-37173?

Yes, a public proof-of-concept exploit is available for CVE-2020-37173. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2020-37173?

Within 24 hours: Identify all Avideo instances in your environment and document their versions. Within 7 days: Implement network access controls restricting the playlistsFromUser function or disable the feature if non-essential; deploy WAF rules to block suspicious enumeration patterns. Within 30 days: Contact vendor for guidance on version 8.2+ timeline, evaluate migration options, or implement mandatory authentication/rate-limiting on affected endpoints.

PHP CVE-2020-37173

HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2026-02-11 disclosure@vulncheck.com

PHP Information Disclosure Avideo

7.5

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 18, 2026 - 19:36 vuln.today

Public exploit code

CVE Published

Feb 11, 2026 - 21:16 nvd

HIGH 7.5

DescriptionNVD

AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.

AnalysisAI

Avideo versions up to 8.1 contains a vulnerability that allows attackers to enumerate user details through the playlistsFromUser (CVSS 7.5).

Technical ContextAI

exists in the playlistsFromUser.json.php component. AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2020-37173 vulnerability details – vuln.today

Back

PHP CVE-2020-37173

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code