Medium severity · published Jun 6, 2025
CVE-2024-50406
A cross-site scripting (XSS) vulnerability has been reported to affect License Center
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
A cross-site scripting (XSS) vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following version:
License Center 1.9.49 and later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
License Center · Qnap
1.9.36 before 1.9.49 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-50406
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-50406
Vendor Advisory
https://www.qnap.com/en/security-advisory/qsa-25-11
More from License Center
9.8
CVE-2024-48863
A command injection vulnerability has been reported to affect License Center
6.5
CVE-2025-53597
A buffer overflow vulnerability has been reported to affect License Center
6.5
CVE-2025-52871
An out-of-bounds read vulnerability has been reported to affect License Center
4.8
CVE-2025-22483
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions
4.4
CVE-2025-62851
License Center