CVE-2020-36897 — QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts…
Published: 2025-12-10 · CVSS: 9.3 · CVSS 4.0
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7