High severity8.8NVD Advisory· Published Dec 10, 2025· Updated Jun 17, 2026
CVE-2020-36900
CVE-2020-36900
Description
All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global administrative privileges when a logged-in user visits the page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:all-dynamics:digital_signage_system:2.0.2:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:all-dynamics:digital_signage_system:2.0.2:*:*:*:*:*:*:*
- (no CPE)range: =2.0.2
- All-Dynamics Software GmbH/Digital Signage Systemv5Range: 2.0.2 (Build 2098) ILP32W
Patches
Vulnerability mechanics
References
4- www.exploit-db.com/exploits/48736nvdExploitThird Party Advisory
- www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5576.phpnvdExploitThird Party Advisory
- www.vulncheck.com/advisories/all-dynamics-digital-signage-system-cross-site-request-forgery-via-user-managementnvdThird Party Advisory
- www.all-dynamics.denvdProduct
News mentions
0No linked articles in our index yet.