Vulnerability · Published Jan 6, 2026 · Assigned by VulnCheck

CVE-2020-36913All-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass

Medium 5.3

In plain English

A medium-severity session fixation in enlogic:show Digital Signage System from All-Dynamics Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 70.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the login process. Attackers can forge HTTP GET requests to welcome.php with a manipulated session token to bypass authentication and potentially execute cross-site request forgery attacks.

Affected products (as reported)

Vendor	Product	Versions
All-Dynamics Software	enlogic:show Digital Signage System	2.0.2 (Build 2098) ILP32W 0/1/3/1597919619

Weakness: CWE-384 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Zero Science Lab Disclosure (ZSL-2020-5577) third-party-advisory
Vendor Changelog for Version 2.0.3 product
Packet Storm Security Exploit Entry exploit
IBM X-Force Vulnerability Database Entry vdb-entry
VulnCheck Advisory: All-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass third-party-advisory
https://packetstorm.news/files/id/158703 exploit