CVE-2020-36897

critical · 9.3

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.

9.3

CVSS

1.3%

EPSS (exploit prob.)

69th

EPSS percentile

2025-12-10

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
howfor	qihang_media_web_digital_signage	3.0.9

Check a specific version with /api/v1/cve/match.

References

http://www.howfor.com
https://www.exploit-db.com/exploits/48751
https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-remote-code-execution
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5582.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5582.php

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-36897