AVideo has 4 CVEs on record. The busiest recent month was February 2026 with 3. The median CVSS is 5.7 (medium). Most affected products: AVideo Platform (3), AVideo (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 0 prev 1
Worst active — by depth score
CVE-2020-37173High· 7.5AVideo Platform 8.1 - Information Disclosure (User Enumeration)53CVE-2026-60092Medium· 6.1AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint46CVE-2020-37172Medium· 5.3AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)41CVE-2020-37158Medium· 5.3AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)41
AVideo vulnerabilities
CVEs affecting AVideo, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-60092Medium· 6.1PoCAVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint
AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross-site scripting vulnerability in the Meet plugin's getMeetInfo.json.php endpoint. When a participant joins a public meeting, the raw HTTP…
CVE-2020-37158Medium· 5.3PoCAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using…
CVE-2020-37172Medium· 5.3PoCAVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using…
CVE-2020-37173High· 7.5PoCAVideo Platform 8.1 - Information Disclosure (User Enumeration)
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, pass…