CVE-2020-36888

Medium · 5.3

CVSS

5.3

EPSS

0.4%

Published

Dec 10, 2025

CISA due date

—

The record

SpinetiX Fusion Digital Signage 3.4.8 contains a username enumeration vulnerability in its login script that allows attackers to identify valid user accounts. Attackers can send crafted login requests with different usernames to distinguish between existing and non-existing accounts by analyzing the server's error responses.

Affected packages

Ecosystem	Package	Introduced	Fixed