CVE-2020-36897

9.3 criticalEPSS 1.3%

Critical (9.3) in howfor qihang media web digital signage. EPSS 1.3% chance of exploitation in the next 30 days.

QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2025-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

howfor:qihang_media_web_digital_signage

References

http://www.howfor.com
https://www.exploit-db.com/exploits/48751
https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-remote-code-execution
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5582.php
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5582.php

Check your stack JSON