HIGH🇵🇱 Wersja polska

CVE-2020-36899

CVSS 8.7v4.0pub. 2025-12-10upd. 2025-12-17

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Howfor Qihang Media Web Digital Signage

    APP
    Howfor
    3.0.9
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2020-36897CRITICAL9.3PL ✓ten sam produkt

RCE bez uwierzytelnienia w Qihang Media Web Digital Signage 3.0.9

CVE-2020-36896HIGH8.7ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthentica...

CVE-2020-36898HIGH8.8ten sam produkt

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx ...