Sensitive Information Disclosure in QiHang Media Web Digital Signage by QiHang Media
CVE-2020-36914

8.6HIGH

Key Information:

Vendor

Shenzhen Xingmeng Qihang Media Co., Ltd.

Status
Qihang Media Web (qh.aspx) Digital Signage
Vendor
CVE Published:
6 January 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-36914?

The QiHang Media Web Digital Signage version 3.0.9 is affected by a vulnerability that allows remote attackers to intercept user authentication credentials. This exploitation results from cleartext cookie transmission, which can facilitate man-in-the-middle attacks, enabling attackers to capture and misuse sensitive stored authentication data. As a result, it's crucial for users to ensure that secure transmission practices are implemented to protect their credentials.

Affected Version(s)

QiHang Media Web (QH.aspx) Digital Signage 3.0.9.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-36914 - Proof of Concept

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-55...
third-party-advisory
https://packetstormsecurity.com/files/158858
exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/186770
vdb-entry

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2020-36914 : Sensitive Information Disclosure in QiHang Media Web Digital Signage by QiHang Media