SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server's error responses.
References
| Link | Resource |
|---|---|
| https://www.exploit-db.com/exploits/48847 | Exploit Third Party Advisory VDB Entry |
| https://www.spinetix.com | Product |
| https://www.vulncheck.com/advisories/spinetix-fusion-digital-signage-username-enumeration-via-login-script | Third Party Advisory |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5591.php | Exploit Third Party Advisory |
| https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5591.php | Exploit Third Party Advisory |
Configurations
History
17 Dec 2025, 16:46
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| References | () https://www.exploit-db.com/exploits/48847 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.spinetix.com - Product | |
| References | () https://www.vulncheck.com/advisories/spinetix-fusion-digital-signage-username-enumeration-via-login-script - Third Party Advisory | |
| References | () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5591.php - Exploit, Third Party Advisory | |
| First Time |
Spinetix fusion Digital Signage
Spinetix |
|
| CPE | cpe:2.3:a:spinetix:fusion_digital_signage:*:*:*:*:*:*:*:* |
11 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5591.php - |
10 Dec 2025, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-10 21:16
Updated : 2025-12-17 16:46
NVD link : CVE-2020-36888
Mitre link : CVE-2020-36888
CVE.ORG link : CVE-2020-36888
JSON object : View
Products Affected
spinetix
- fusion_digital_signage
CWE
CWE-203
Observable Discrepancy