CVE-2020-36900: All-Dynamics Digital Signage System

High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days.

All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global administrative privileges when a logged-in user visits the page.

Affected products

• All-Dynamics Digital Signage System: version 2.0.2 only

Published 2025-12-10. Last modified 2026-06-17.