PT-2025-50512 · Spinetix · Spinetix Fusion

Published 2025-12-10 · Updated 2025-12-11 · CVE-2020-36888

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SpinetiX Fusion Digital Signage version 3.4.8

Description The software contains a flaw in its login script that allows attackers to identify valid user accounts through username enumeration. Attackers can send specially crafted login requests with different usernames and analyze the server's error responses to determine which accounts exist.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2020-36888

Affected Products

Spinetix Fusion

References · 8

• 🔥 https://exploit-db.com/exploits/48847 · Exploit
• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5591.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36888 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36888 · Vendor Advisory
• https://vulncheck.com/advisories/spinetix-fusion-digital-signage-username-enumeration-via-login-script · Note
• https://twitter.com/CVEnew/status/1999108937254367412 · Twitter Post
• https://spinetix.com · Note
• https://t.me/CVEtracker/39396 · Telegram Post