VendorsQNAPqtsall versions
Vulnerabilities

QNAP QTS

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

320CVEs
CVE-2023-23372
QTS, QuTS hero
Published 2023-12-08 · Modified
6.5EPSS 0.005
CVE-2025-48730
QTS, QuTS hero
Published 2025-10-03 · Analyzed
6.5EPSS 0.004
CVE-2025-62858
QTS, QuTS hero
Published 2026-06-09 · Analyzed
6.5EPSS 0.004
CVE-2025-48721
QTS, QuTS hero
Published 2026-01-02 · Analyzed
6.5EPSS 0.004
CVE-2026-24717
QTS, QuTS hero
Published 2026-06-10 · Modified
6.5EPSS 0.004
CVE-2025-30265
QTS, QuTS hero
Published 2025-08-29 · Analyzed
6.5EPSS 0.004
CVE-2025-30268
QTS, QuTS hero
Published 2025-08-29 · Analyzed
6.5EPSS 0.004
CVE-2025-30267
QTS, QuTS hero
Published 2025-08-29 · Analyzed
6.5EPSS 0.004
CVE-2024-21904
QTS, QuTS hero
Published 2024-09-06 · Analyzed
6.5EPSS 0.004
CVE-2025-53407
QTS, QuTS hero
Published 2025-10-03 · Analyzed
6.5EPSS 0.004
CVE-2025-53406
QTS, QuTS hero
Published 2025-10-03 · Analyzed
6.5EPSS 0.004
CVE-2025-52429
QTS, QuTS hero
Published 2025-10-03 · Analyzed
6.5EPSS 0.004
CVE-2025-62852
QTS, QuTS hero
Published 2026-01-02 · Analyzed
6.5EPSS 0.004
CVE-2025-53593
QTS, QuTS hero
Published 2026-01-02 · Analyzed
6.5EPSS 0.004
CVE-2025-53592
QTS, QuTS hero
Published 2026-01-02 · Analyzed
6.5EPSS 0.003
CVE-2025-44013
QTS, QuTS hero
Published 2026-01-02 · Analyzed
6.5EPSS 0.003
CVE-2025-47208
QTS, QuTS hero
Published 2026-01-02 · Analyzed
6.5EPSS 0.003
CVE-2025-53591
QTS, QuTS hero
Published 2026-01-02 · Analyzed
6.5EPSS 0.003
CVE-2023-32967
QTS, QuTScloud
Published 2024-02-02 · Modified
6.5EPSS 0.003
CVE-2023-51368
QTS, QuTS hero
Published 2024-09-06 · Analyzed
6.5EPSS 0.003
CVE-2025-30274
QTS, QuTS hero
Published 2025-08-29 · Analyzed
6.5EPSS 0.003
CVE-2025-30272
QTS, QuTS hero
Published 2025-08-29 · Analyzed
6.5EPSS 0.003
CVE-2023-34972
QTS, QuTS hero and QuTScloud
Published 2023-08-24 · Modified
6.5EPSS 0.002
CVE-2026-41539
QTS, QuTS hero
Published 2026-06-09 · Modified
6.3EPSS 0.003
CVE-2018-19953
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
Published 2020-10-28 · Analyzed
6.1KEVEPSS 0.288
CVE-2020-2495
Cross-site scripting vulnerability in QTS and QuTS hero
Published 2020-12-10 · Modified
6.1EPSS 0.010
CVE-2020-2496
Cross-site scripting vulnerability in QTS and QuTS hero
Published 2020-12-10 · Modified
6.1EPSS 0.010
CVE-2015-5664
Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 2016-07-03 · Modified
6.1EPSS 0.010
CVE-2020-2494
Cross-site Scripting Vulnerability in Music Station
Published 2020-12-10 · Modified
6.1EPSS 0.010
CVE-2020-2491
Cross-site Scripting Vulnerability in Photo Station
Published 2020-12-10 · Modified
6.1EPSS 0.010
CVE-2020-2497
Cross-site scripting vulnerability in QTS and QuTS hero
Published 2020-12-10 · Modified
6.1EPSS 0.010
CVE-2018-0711
Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
Published 2018-04-30 · Modified
6.1EPSS 0.009
CVE-2017-13072
Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.
Published 2018-06-21 · Modified
6.1EPSS 0.008
CVE-2018-0716
Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions could allow remote attackers to inject Javascript code in the compromised application.
Published 2018-11-30 · Modified
6.1EPSS 0.008
CVE-2018-19951
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
Published 2020-11-02 · Modified
6.1EPSS 0.008
CVE-2017-7631
Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML.
Published 2018-03-27 · Modified
6.1EPSS 0.008
CVE-2017-7634
Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page.
Published 2018-03-08 · Modified
6.1EPSS 0.008
CVE-2017-7632
Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web script or HTML.
Published 2018-03-27 · Modified
6.1EPSS 0.008
CVE-2021-44053
Reflected XSS
Published 2022-05-05 · Modified
6.1EPSS 0.008
CVE-2018-19942
Cross-site Scripting Vulnerability in File Station
Published 2021-04-16 · Modified
6.1EPSS 0.007
← Prev6 / 8Next →