Read the docs

QNAP

Records682All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical101CVSS 9.0–10.0
CVSS high234CVSS 7.0–8.9

Exploited now

QNAP records in CISA KEV
TI-2023-25733 QNAP VioStor NVR OS Command Injection Vulnerability Priority CRITICAL 97KEV 2023-12-21TI-2022-10581 QNAP Photo Station Externally Controlled Reference Vulnerability Priority CRITICAL 100KEV 2022-09-08TI-2019-05100 QNAP Photo Station Improper Access Control Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05101 QNAP QTS Improper Input Validation Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05102 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08TI-2019-05103 QNAP Photo Station Path Traversal Vulnerability Priority CRITICAL 100KEV 2022-06-08

Components

Products in the NVD configurations · select one to filter the records
Qts 283 records CRITICAL Quts Hero 234 records CRITICAL Qsync Central 62 records MEDIUM Qutscloud 62 records HIGH File Station 57 records LOW Photo Station 26 records CRITICAL Video Station 21 records MEDIUM Media Streaming Add-on 13 records MEDIUM

Records

21 records in Video Station · all components

TI-2017-09713 CVE-2017-13071 · GHSA-3666-cq3x-qwx9

Command injection in QNAP Video Station

Priority MEDIUM 45

QNAP has already patched this vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01444 Published 2017-11-22 No fix listed CWE-77
TI-2023-17466 CVE-2023-34976 · GHSA-p9mf-x9hh-r538

SQL injection in QNAP Video Station

Priority MEDIUM 44

A SQL injection vulnerability has been reported to affect Video Station.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00609 Published 2023-10-13 Fixed in 5.7.0 ( 2023/07/27 ) CWE-89
TI-2021-19805 CVE-2021-44056 · GHSA-rq2w-6955-5m7c

Improper authentication in Video Station

Priority MEDIUM 44

An improper authentication vulnerability has been reported to affect QNAP device running Video Station.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00928 Published 2022-05-05 Fixed in 5.5.9, 5.3.13 +1 CWE-287
TI-2021-19804 CVE-2021-44055 · GHSA-r855-rqcr-vpfp

Information leakage in Video Station

Priority MEDIUM 44

An missing authorization vulnerability has been reported to affect QNAP device running Video Station.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0106 Published 2022-05-05 Fixed in 5.5.9 ( 2022/02/16 ) CWE-862
TI-2026-74713 CVE-2026-44084 · GHSA-2qpr-rvc3-jx3g

Access code forgery in QNAP Video Station exposes media

Priority MEDIUM 43

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00313 Published 2026-10-15 Fixed in 5.8.8 CWE-639
TI-2023-21889 CVE-2023-41288 · GHSA-frmj-qjf3-xxj4

OS command injection in QNAP Video Station

Priority MEDIUM 42

An OS command injection vulnerability has been reported to affect Video Station.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0114 Published 2024-01-05 Fixed in 5.7.2 ( 2023/11/23 ) CWE-78
TI-2023-21888 CVE-2023-41287 · GHSA-chg5-w539-53mr

SQL injection in QNAP Video Station

Priority MEDIUM 41

A SQL injection vulnerability has been reported to affect Video Station.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00505 Published 2024-01-05 Fixed in 5.7.2 ( 2023/11/23 ) CWE-89
TI-2023-17465 CVE-2023-34975 · GHSA-grxq-cfv6-jw9w

OS command injection in QNAP QuTS hero

Priority MEDIUM 41

An OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01221 Published 2023-10-13 Fixed in h4.5.4.2626 build 20231225, 4.5.4.2627 build 20231225 +1 CWE-78
TI-2021-09803 CVE-2021-28812 · GHSA-c2r6-6wr8-rvc4

Command Injection Vulnerability in Video Station

Priority MEDIUM 41

A command injection vulnerability has been reported to affect certain versions of Video Station.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01553 Published 2021-06-03 Fixed in 5.5.4, 5.3.x +1 CWE-1286
TI-2023-27548 CVE-2023-50360 · GHSA-5x78-3xcj-2hqh

SQL injection in QNAP Video Station

Priority MEDIUM 40

A SQL injection vulnerability has been reported to affect Video Station.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00432 Published 2024-09-06 Fixed in 5.8.1 ( 2024/02/26 ) CWE-89
TI-2023-25731 CVE-2023-47563 · GHSA-j3f7-j487-wx5j

Command injection in QNAP Video Station

Priority MEDIUM 40

An OS command injection vulnerability has been reported to affect Video Station.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00965 Published 2024-09-06 Fixed in 5.8.2 CWE-77
TI-2024-37673 CVE-2024-56804 · GHSA-jp33-6gvv-f2w8

SQL injection in QNAP Video Station

Priority LOW 32

An SQL injection vulnerability has been reported to affect Video Station.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0038 Published 2025-10-03 Fixed in 5.8.4 CWE-89
TI-2026-74700 CVE-2026-26244 · GHSA-56p7-9gfr-8cpw

SQL Injection in QNAP Video Station

Priority LOW 31

A SQL injection vulnerability has been reported to affect Video Station.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00377 Published 2026-10-15 Fixed in 5.8.8 CWE-89
TI-2019-05098 CVE-2019-7184 · GHSA-98f4-whjp-x56x

Cross-site scripting in QNAP NAS devices running Video Station

Priority LOW 25

This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01456 Published 2019-12-05 No fix listed CWE-79
TI-2023-17467 CVE-2023-34977 · GHSA-fm9q-gf87-g4h8

Cross-site scripting in QNAP Video Station

Priority LOW 24

A cross-site scripting (XSS) vulnerability has been reported to affect Video Station.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00347 Published 2023-10-13 Fixed in 5.7.0 ( 2023/07/27 ) CWE-79
TI-2024-13019 CVE-2024-14025 · GHSA-cf9c-xp8q-h55h

SQL injection in QNAP Video Station

Priority LOW 2

An SQL injection vulnerability has been reported to affect Video Station.

CVSS 4.0LOW 0.1 Physical High privileges No interaction EPSS 0.00155 Published 2026-03-11 Fixed in 5.8.2 CWE-89
TI-2024-13018 CVE-2024-14024 · GHSA-vwf6-h3r8-8jfj

Improper certificate validation in QNAP Video Station

Priority LOW 2

An improper certificate validation vulnerability has been reported to affect Video Station.

CVSS 4.0LOW 0.1 Physical High privileges No interaction EPSS 0.00084 Published 2026-03-11 Fixed in 5.8.2 CWE-295
Open these records in search →