Read the docs
TI-2025-16374 Aliases CVE-2025-22483GHSA-556x-fx4f-2hgg

Cross-site scripting in QNAP License Center

Priority LOW 33CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: License Center 1.8.51 and later License Center 1.9.51 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix Fixed License Center (QNAP Systems Inc.): 1.8.51, 1.9.51

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPLicense Center1.8.x to before 1.8.51; 1.9.x to before 1.9.511.8.51, 1.9.51Patch availableCNA
  • License Center VendorQNAP Affected 1.8.x to before 1.8.51; 1.9.x to before 1.9.51 Fixed in 1.8.51, 1.9.51 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:qnap:license_center:*:*:*:*:*:*:*:*1.8.17 to before 1.8.51; 1.9.36 to before 1.9.51VulnerableQNAP
  • cpe:2.3:a:qnap:license_center:*:*:*:*:*:*:*:* Versions 1.8.17 to before 1.8.51; 1.9.36 to before 1.9.51 Vulnerable ·QNAP

Remediation

  • Fix · CNA License Center (QNAP Systems Inc.) Fixed in 1.8.51, 1.9.51

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22483
  2. 2026-10-03 Alias added: GHSA-556x-fx4f-2hgg

References

Advisory 1

  • TI-2024-32563 OS command injection in QNAP License Center CVSS 4.0HIGH 7.7
  • TI-2025-39004 Path traversal in QNAP License Center CVSS 4.0MEDIUM 4.6
  • TI-2024-33839 Cross-site scripting in QNAP License Center CVSS 4.0LOW 2.0
  • TI-2025-33534 Stack-based buffer overflow in QNAP License Center CVSS 4.0LOW 1.2
  • TI-2025-32908 Out-of-bounds read in QNAP License Center CVSS 4.0LOW 1.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences