rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-36891 Kentico Xperience <= 12.0.49 File Upload Stored XSS
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Kentico
product: Xperience
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Ataberk Yavuzer
Published: 2025-12-18T19:53:26.107Z
CVE-2020-36892 Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege Escalation
Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: EIBIZ Co.,Ltd.
product: i-Media Server Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:52:17.172Z
CVE-2020-36893 Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability
Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: EIBIZ Co.,Ltd.
product: i-Media Server Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:52:52.187Z
CVE-2020-36894 Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated User Creation Vulnerability
Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through AMF-encoded object manipulation. Attackers can send crafted serialized objects to the /messagebroker/amf endpoint to create administrative users without authentication, bypassing security controls.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: EIBIZ Co.,Ltd.
product: i-Media Server Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:53:33.232Z
CVE-2020-36895 EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure
EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.
Problem types: cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: EIBIZ Co.,Ltd.
product: i-Media Server Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:54:29.438Z
CVE-2020-36896 QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
Problem types: cwe_id: CWE-522
description: CWE-522: Insufficiently Protected Credentials
Affected products: vendor: Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology Co., Ltd.
product: QiHang Media Web Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T20:55:02.794Z
CVE-2020-36897 QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd.
product: QiHang Media Web Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T21:02:56.142Z
CVE-2020-36898 QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology Co., Ltd.
product: QiHang Media Web Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T21:03:26.361Z
CVE-2020-36899 QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Disclosure
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.
Problem types: cwe_id: CWE-530
description: CWE-530: Exposure of Backup File to an Unauthorized Control Sphere
Affected products: vendor: Shenzhen Xingmeng Qihang Media Co., Ltd. Guangzhou Hefeng Automation Technology Co., Ltd.
product: QiHang Media Web Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T21:03:57.079Z
CVE-2020-36900 All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management
All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global administrative privileges when a logged-in user visits the page.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: All-Dynamics Software GmbH
product: Digital Signage System
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T21:04:43.623Z
CVE-2020-36901 UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management
UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: UBICOD Co., Ltd. | MEDIVISION INC.
product: UBICOD Medivision Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T21:05:21.945Z
CVE-2020-36902 UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges
UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication.
Problem types: cwe_id: CWE-862
description: CWE-862: Missing Authorization
Affected products: vendor: UBICOD Co., Ltd. | MEDIVISION INC.
product: UBICOD Medivision Digital Signage
default_status: unaffected
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-10T21:05:41.753Z
CVE-2020-36903 Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path
Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execute code with elevated privileges. Attackers can exploit the service's unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during application startup or reboot.
Problem types: cwe_id: CWE-428
description: Unquoted Search Path or Element
Affected products: vendor: Selea
product: Selea CarPlateServer (CPS)
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-31T18:39:08.084Z
CVE-2020-36904 Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint
Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration, including changing admin passwords and executing system commands.
Problem types: cwe_id: CWE-306
description: Missing Authentication for Critical Function
Affected products: vendor: Selea
product: Selea CarPlateServer (CPS)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2025-12-31T18:39:08.542Z
CVE-2020-36905 FIBARO System Home Center 5.021 Remote File Inclusion via Proxy API
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.
Problem types: cwe_id: CWE-829
description: Inclusion of Functionality from Untrusted Control Sphere
Affected products: vendor: FIBAR GROUP S.A.
product: Home Center 3
vendor: FIBAR GROUP S.A.
product: Home Center 2
vendor: FIBAR GROUP S.A.
product: Home Center Lite
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:20.162Z
CVE-2020-36906 P5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User Management
P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted form.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: P5
product: FNIP-8x16A
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: iej1ctk1g
Published: 2026-01-06T15:52:20.766Z
CVE-2020-36907 Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service
Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption.
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling
Affected products: vendor: Extreme Networks
product: Aerohive HiveOS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:21.277Z
CVE-2020-36908 Secure Computing SnapGear Management Console SG560 3.1.5 Cross-Site Request Forgery via Admin Users
SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft a malicious web page that automatically submits a form to create a new super user account with full administrative privileges when a logged-in user visits the page.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF)
Affected products: vendor: Secure Computing
product: SnapGear Management Console SG560
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:21.719Z
CVE-2020-36909 Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read/Write
SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. Attackers can manipulate POST request parameters in /cgi-bin/cgix/edit_config_files to access and modify files outside the intended /etc/config/ directory.
Problem types: cwe_id: CWE-22
description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Secure Computing
product: SnapGear Management Console SG560
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:22.155Z
CVE-2020-36910 Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
Problem types: cwe_id: CWE-78
description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: CAYIN Technology
product: SMP-8000QD
vendor: CAYIN Technology
product: SMP-8000
vendor: CAYIN Technology
product: SMP-6000
vendor: CAYIN Technology
product: SMP-4000
vendor: CAYIN Technology
product: SMP-2310
vendor: CAYIN Technology
product: SMP-2300
vendor: CAYIN Technology
product: SMP-2210
vendor: CAYIN Technology
product: SMP-2200
vendor: CAYIN Technology
product: SMP-2100
vendor: CAYIN Technology
product: SMP-2000
vendor: CAYIN Technology
product: SMP-1000
vendor: CAYIN Technology
product: SMP-PROPLUS
vendor: CAYIN Technology
product: SMP-WEBPLUS
vendor: CAYIN Technology
product: SMP-WEB4
vendor: CAYIN Technology
product: SMP-300
vendor: CAYIN Technology
product: SMP-200
vendor: CAYIN Technology
product: SMP-PRO4
vendor: CAYIN Technology
product: SMP-NEO2
vendor: CAYIN Technology
product: SMP-NEO
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:22.576Z
CVE-2020-36911 Covenant 0.5 - Remote Code Execution (RCE)
Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.
Problem types: cwe_id: CWE-798
description: Use of Hard-coded Credentials
Affected products: vendor: Cobbr
product: Covenant
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: coastal
Published: 2026-01-13T22:51:37.380Z
CVE-2020-36912 Plexus anblick Digital Signage Management 3.1.13 Open Redirect via Pagina Parameter
Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the 'pagina' GET parameter. Attackers can craft malicious links that redirect users to arbitrary websites by exploiting improper input validation in the parameter.
Problem types: cwe_id: CWE-601
description: URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Plexus
product: Plexus anblick Digital Signage Management
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:23.088Z
CVE-2020-36913 All-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass
All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the login process. Attackers can forge HTTP GET requests to welcome.php with a manipulated session token to bypass authentication and potentially execute cross-site request forgery attacks.
Problem types: cwe_id: CWE-384
description: Session Fixation
Affected products: vendor: All-Dynamics Software
product: enlogic:show Digital Signage System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:23.519Z
CVE-2020-36914 QiHang Media Web Digital Signage 3.0.9 Cookie Authentication Credentials Disclosure
QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication credentials through cleartext cookie transmission. Attackers can perform man-in-the-middle attacks to capture and potentially misuse stored authentication credentials transmitted in an insecure manner.
Problem types: cwe_id: CWE-319
description: Cleartext Transmission of Sensitive Information
Affected products: vendor: Shenzhen Xingmeng Qihang Media Co., Ltd.
product: QiHang Media Web (QH.aspx) Digital Signage
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:53:22.029Z
CVE-2020-36915 Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials
Adtec Digital SignEdje Digital Signage Player v2.08.28 contains multiple hardcoded default credentials that allow unauthenticated remote access to web, telnet, and SSH interfaces. Attackers can exploit these credentials to gain root-level access and execute system commands across multiple Adtec Digital product versions.
Problem types: cwe_id: CWE-798
description: Use of Hard-coded Credentials
cwe_id: CWE-1392
description: Use of Default Credentials
Affected products: vendor: Adtecdigital
product: SignEdje Digital Signage Player
vendor: Adtecdigital
product: mediaHUB HD-Pro High & Standard Definition MPEG2 Encoder
vendor: Adtecdigital
product: afiniti Multi-Carrier Platform
vendor: Adtecdigital
product: EN-31 Dual Channel DSNG Encoder / Modulator
vendor: Adtecdigital
product: EN-210 Multi-CODEC 10-bit Encoder / Modulator
vendor: Adtecdigital
product: EN-200 1080p AVC Low Latency Encoder / Modulator
vendor: Adtecdigital
product: ED-71 10-bit / 1080p Integrated Receiver Decoder
vendor: Adtecdigital
product: edje-5110 Standard Definition MPEG2 Encoder
vendor: Adtecdigital
product: edje-4111 HD Digital Media Player
vendor: Adtecdigital
product: Soloist HD-Pro Broadcast Decoder
vendor: Adtecdigital
product: adManage Traffic & Media Management Application
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-01-06T15:52:24.350Z