CVE-2024-12923

Photo Station

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: Photo Station 6.4.5 ( 2025/01/02 ) and later

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Photo Station

CVE-2025-33032

QTS, QuTS hero

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30267

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30265

QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-29882

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30268

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30270

QTS, QuTS hero

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30271

QTS, QuTS hero

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30272

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30273

QTS, QuTS hero

An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2025-30274

QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.5.3145 build 20250526 and later QuTS hero h5.2.5.3138 build 20250519 and later

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qts Quts Hero

CVE-2024-32770

Photo Station

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Photo Station

CVE-2023-47221

Photo Station

A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 ( 2023/12/15 ) and later

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Photo Station

CVE-2025-29892

Qsync Central

An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6 ( 2025/03/20 ) and later

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qsync Central

CVE-2025-22482

Qsync Central

A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.6 ( 2025/03/20 ) and later

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Qsync Central

CVE-2024-38643

Notes Station 3

A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to gain access to and execute certain functions. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Notes Station 3

CVE-2024-38644

Notes Station 3

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to execute commands. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later

CVSS 4.0 · 8.7 High EPSS 1.6% KEV · Not listed

Vendors

Qnap

Products

Notes Station 3

CVE-2024-38645

Notes Station 3

A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to read application data. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Notes Station 3

CVE-2024-38646

Notes Station 3

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or modify the resource. We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Notes Station 3

CVE-2024-32767

Photo Station

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Qnap

Products

Photo Station