CVEvulnerability
CVE-2020-36898
8.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.8 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Weaknesses
- CWE-22
Description
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.
Affected configurations
• howfor qihang media web digital signage 3.0.9
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://www.howfor.com Product
- https://www.exploit-db.com/exploits/48749 Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-arbitrary-file-deletion Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php Exploit, Third Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php Exploit, Third Party Advisory