# QiHang Media Web Digital Signage 3.0.9 sends login credentials in cleartext cookies

- Date: 2026-01-06
- Location: Global
- Type: Vulnerability
- Sector: Vendor
- CVE: CVE-2020-36914

NVD published a cleartext credentials flaw in QiHang Media Web Digital Signage. In version 3.0.9, remote attackers can intercept user authentication credentials sent as cleartext cookies.

## Sources

- [CVE-2020-36914](https://nvd.nist.gov/vuln/detail/CVE-2020-36914) (NIST NVD)
- [https://cxsecurity.com/issue/WLB-2020080059](https://cxsecurity.com/issue/WLB-2020080059)
- [https://exchange.xforce.ibmcloud.com/vulnerabilities/186770](https://exchange.xforce.ibmcloud.com/vulnerabilities/186770)

Page: https://signagelist.org/incidents/2026-01-qihang-media-web-digital-signage-3-0/