PT-2025-50511 · Spinetix · Spinetix Fusion Digital Signage

Published 2025-12-10 · Updated 2025-12-11 · CVE-2020-36887

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SpinetiX Fusion Digital Signage version 3.4.8

Description An unauthenticated information disclosure issue exists in SpinetiX Fusion Digital Signage. An attacker can access the /content/files/backups/ API endpoint to download sensitive backup files. These files contain user credentials and system information. The database backup directory is the location of the disclosed information.

Recommendations Restrict access to the /content/files/backups/ API endpoint.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-36887

Affected Products

Spinetix Fusion Digital Signage

References · 8

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5593.php · Exploit
• 🔥 https://exploit-db.com/exploits/48845 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36887 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36887 · Vendor Advisory
• https://spinetix.com · Note
• https://vulncheck.com/advisories/spinetix-fusion-digital-signage-unauthenticated-database-backup-disclosure · Note
• https://t.me/CVEtracker/39395 · Telegram Post
• https://twitter.com/CVEnew/status/1999108938445488192 · Twitter Post