Is CVE-2020-37173 actively exploited?

A weaponized exploit exists for CVE-2020-37173, making exploitation likely. It is not yet confirmed in the CISA KEV catalog.

Can CVE-2020-37173 be exploited remotely?

Yes. CVE-2020-37173 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-37173?

CVE-2020-37173 has a CVSS score of 7.5 (HIGH) and an EPSS exploitation probability of 0.09%.

HOME VULNERABILITIESCVE-2020-37173

HIGHWEAPONIZED

CVE-2020-37173

CWE-359Published: February 11, 2026· Updated: Feb 18, 2026

7.5

CVSS v3.1

EPSS:0.09%probability of exploitation in 30 daysPercentile:25.6th

Official Description

AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.

NVD Source

Risk Analysis

This high-severity information disclosure vulnerability in AVideo Platform 8.1 allows attackers to enumerate sensitive user details, including email and password hashes. With a CVSS score of 7.5, this flaw poses a significant risk to user privacy and security. The low EPSS score suggests a lower likelihood of widespread exploitation, but the weaponized status means it is actively being used.

A weaponized exploit for this vulnerability is available, meaning it is being actively leveraged by attackers. The flaw is remotely exploitable without authentication, allowing widespread data exfiltration.

Recommended Action

Administrators of AVideo Platform 8.1 should apply the latest security patches or upgrade to a patched version immediately. Review user accounts for any unauthorized access or changes in credentials.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2020-37173 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.

A weaponized exploit for CVE-2020-37173 is publicly known. This significantly lowers the barrier for threat actors and increases the urgency for remediation.