CRITICALπŸ‡΅πŸ‡± Wersja polska

CVE-2020-36897

CVSS 9.3v4.0pub. 2025-12-10upd. 2025-12-17

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Howfor Qihang Media Web Digital Signage

    APP
    Howfor
    3.0.9
πŸ”΅
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2020-36896HIGH8.7ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthentica...

CVE-2020-36898HIGH8.8ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx ...

CVE-2020-36899HIGH8.7ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows r...

CVE-2020-36897 β€” Howfor β€” Qihang Media Web Digital Signage β€” CRITICAL β€” CVSS 9.3 | CVEbaza.pl