CVE-2020-36898

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-36898
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.howfor.com Product
https://www.exploit-db.com/exploits/48749 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-arbitrary-file-deletion Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php Exploit Third Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:howfor:qihang_media_web_digital_signage:3.0.9:*:*:*:*:*:*:*
History

17 Dec 2025, 19:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.1
First Time Howfor
Howfor qihang Media Web Digital Signage
References () http://www.howfor.com - () http://www.howfor.com - Product
References () https://www.exploit-db.com/exploits/48749 - () https://www.exploit-db.com/exploits/48749 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-arbitrary-file-deletion - () https://www.vulncheck.com/advisories/qihang-media-web-digital-signage-unauthenticated-arbitrary-file-deletion - Third Party Advisory
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php - Exploit, Third Party Advisory
CPE cpe:2.3:a:howfor:qihang_media_web_digital_signage:3.0.9:*:*:*:*:*:*:*

11 Dec 2025, 19:15

Type Values Removed Values Added
References () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php - () https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5580.php -

10 Dec 2025, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-10 21:16

Updated : 2025-12-17 19:16

NVD link : CVE-2020-36898

Mitre link : CVE-2020-36898

CVE.ORG link : CVE-2020-36898

JSON object : View

Products Affected

howfor

  • qihang_media_web_digital_signage
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')