Read the docs

QNAP

Records682All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical101CVSS 9.0–10.0
CVSS high234CVSS 7.0–8.9

Exploited now

QNAP records in CISA KEV
TI-2023-25733 QNAP VioStor NVR OS Command Injection Vulnerability Priority CRITICAL 97KEV 2023-12-21TI-2022-10581 QNAP Photo Station Externally Controlled Reference Vulnerability Priority CRITICAL 100KEV 2022-09-08TI-2019-05100 QNAP Photo Station Improper Access Control Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05101 QNAP QTS Improper Input Validation Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05102 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05103 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08

Components

Products in the NVD configurations · select one to filter the records
Qts 283 records CRITICAL Quts Hero 234 records CRITICAL Qsync Central 62 records MEDIUM Qutscloud 62 records HIGH File Station 57 records LOW Photo Station 26 records CRITICAL Video Station 21 records MEDIUM Media Streaming Add-on 13 records MEDIUM

Records

26 records in Photo Station · all components

TI-2022-10581 CVE-2022-27593 · GHSA-c84w-pfmp-9cxg

DeadBolt Ransomware

Priority CRITICAL 100KEV

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.87908 Published 2022-09-08 Fixed in 6.1.2, 6.0.22 +3 CWE-610
TI-2019-05103 CVE-2019-7195 · GHSA-5h7g-3542-fw4q

Path traversal in QNAP NAS devices running Photo Station

Priority CRITICAL 100KEV

This external control of file name or path vulnerability allows remote attackers to access or modify system files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89323 Published 2019-12-05 No fix listed CWE-22
TI-2019-05102 CVE-2019-7194 · GHSA-4wch-cg8h-vqc6

Path traversal in QNAP NAS devices running Photo Station

Priority CRITICAL 100KEV

This external control of file name or path vulnerability allows remote attackers to access or modify system files.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82713 Published 2019-12-05 No fix listed CWE-22
TI-2017-14276 CVE-2017-20210 · GHSA-m9pp-qvj7-2q6c

Information disclosure in QNAP Photo Station

Priority MEDIUM 49

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00369 Published 2025-11-11 Fixed in 5.4.1, 5.2.7 CWE-200
TI-2021-19806 CVE-2021-44057 · GHSA-9mp7-fmr4-g9vw

Improper authentication in Photo Station

Priority MEDIUM 44

An improper authentication vulnerability has been reported to affect QNAP device running Photo Station.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00928 Published 2022-05-05 Fixed in 6.0.20 ( 2022/02/15 ), 5.7.16 ( 2022/02/11 ) +1 CWE-287
TI-2023-25730 CVE-2023-47562 · GHSA-36w5-pmj5-pph2

Command injection in QNAP Photo Station

Priority MEDIUM 40

An OS command injection vulnerability has been reported to affect Photo Station.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01111 Published 2024-02-02 Fixed in 6.4.2 ( 2023/12/15 ) CWE-77
TI-2018-00674 CVE-2018-0722 · GHSA-r7gm-6ww8-qrxr

Path traversal in QNAP Photo Station

Priority LOW 36

Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the d…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01741 Published 2019-02-01 No fix listed CWE-22
TI-2021-13395 CVE-2021-34356 · GHSA-8gh9-2qqw-fwfv

Stored XSS Vulnerability in Photo Station

Priority LOW 34

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00649 Published 2021-10-01 Fixed in 6.0.18 ( 2021/09/01 ) CWE-79
TI-2021-13394 CVE-2021-34355 · GHSA-673r-qghc-fvv3

Stored XSS Vulnerability in Photo Station

Priority LOW 34

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00649 Published 2021-10-01 Fixed in 5.4.10 ( 2021/08/19 ), 5.7.13 ( 2021/08/19 ) +1 CWE-79
TI-2021-13393 CVE-2021-34354 · GHSA-rv2c-7323-hh89

Stored Cross-site Scripting Vulnerability in Photo Station

Priority LOW 34

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00649 Published 2021-10-01 Fixed in 6.0.18 ( 2021/09/01 ) CWE-79
TI-2018-00669 CVE-2018-0715 · GHSA-6xx8-3r7c-vg48

Cross-site scripting in QNAP Photo Station

Priority LOW 33

Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.03122 Published 2018-08-27 No fix listed CWE-79
TI-2020-02214 CVE-2020-2502 · GHSA-rfgf-6g5x-fx98

Cross-site Scripting Vulnerability in Photo Station

Priority LOW 29

This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00827 Published 2021-02-17 Fixed in 6.0.11 CWE-79
TI-2020-02203 CVE-2020-2491 · GHSA-whf5-659f-c55w

Cross-site Scripting Vulnerability in Photo Station

Priority LOW 29

This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00993 Published 2020-12-10 Fixed in 6.0.12, 5.7.12 +3 CWE-79
TI-2018-14144 CVE-2018-19956 · GHSA-2qf4-9rx4-94ww

Cross-site scripting in QNAP Photo Station

Priority LOW 29

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00917 Published 2020-11-02 Fixed in 5.7.11, 6.0.10 CWE-79
TI-2018-14143 CVE-2018-19955 · GHSA-r57c-c5gj-4hr8

Cross-site scripting in QNAP Photo Station

Priority LOW 29

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00917 Published 2020-11-02 Fixed in 5.7.11, 6.0.10 CWE-79
TI-2018-14142 CVE-2018-19954 · GHSA-rgf7-wr77-vhqc

Cross-site scripting in QNAP Photo Station

Priority LOW 29

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00917 Published 2020-11-02 Fixed in 5.7.11, 6.0.10 CWE-79
TI-2017-09715 CVE-2017-13073 · GHSA-8wjw-3m53-2385

Cross-site scripting in QNAP Photo Station

Priority LOW 29

Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00757 Published 2018-04-23 No fix listed CWE-79
TI-2024-21644 CVE-2024-32770 · GHSA-4ff2-gcjj-67wv

Cross-site scripting in QNAP Photo Station

Priority LOW 28

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00388 Published 2024-11-22 Fixed in 6.4.3 ( 2024/07/12 ) CWE-79
TI-2024-21643 CVE-2024-32769 · GHSA-4pcc-26wc-h35r

Cross-site scripting in QNAP Photo Station

Priority LOW 28

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00388 Published 2024-11-22 Fixed in 6.4.3 ( 2024/07/12 ) CWE-79
TI-2024-21642 CVE-2024-32768 · GHSA-6mqr-4g8p-wrvx

Cross-site scripting in QNAP Photo Station

Priority LOW 28

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00388 Published 2024-11-22 Fixed in 6.4.3 ( 2024/07/12 ) CWE-79
TI-2024-21641 CVE-2024-32767 · GHSA-xwww-jpfc-7835

Cross-site scripting in QNAP Photo Station

Priority LOW 28

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00388 Published 2024-11-22 Fixed in 6.4.3 ( 2024/07/12 ) CWE-79
TI-2023-25539 CVE-2023-47221 · GHSA-2v7w-v8fj-mf99

Path traversal in QNAP Photo Station

Priority LOW 25

A path traversal vulnerability has been reported to affect Photo Station.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.0045 Published 2024-03-08 Fixed in 6.4.2 ( 2023/12/15 ) CWE-22
TI-2023-25729 CVE-2023-47561 · GHSA-27rv-vgm8-cv35

Cross-site scripting in QNAP Photo Station

Priority LOW 24

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00262 Published 2024-02-02 Fixed in 6.4.2 ( 2023/12/15 ) CWE-79
Load more
Open these records in search →