VULNERABILITY INTELLIGENCE
CVE-2020-36899
CVSS score7.5 HIGH
EPSS probability0.92%
CISA KEVNot currently listed
Published2025-12-10
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.
Weakness classification
- disclosure@vulncheck.com: CWE-530
Primary references
- disclosure@vulncheck.com — Product
- disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
- disclosure@vulncheck.com — Third Party Advisory
- disclosure@vulncheck.com — Exploit, Third Party Advisory
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory, VDB Entry
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory