PS
Product
Photo Station
On CISA KEVExploited in the wildRansomware-linked
26
CVEs
4
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 2Medium 17Low 0
Watch
Add Photo Station to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-7195 RansomwareIn wildKEV | 9.8 | Dec 5 | QNAP Photo Station Path Traversal Vulnerability Affected: before 6.0.3; before 5.7.10; before 5.4.9; before 5.2.11 |
| CVE-2019-7194 RansomwareIn wildKEV | 9.8 | Dec 5 | QNAP Photo Station Path Traversal Vulnerability Affected: before 6.0.3; before 5.7.10; before 5.4.9; before 5.2.11 |
| CVE-2019-7192 RansomwareIn wildKEV | 9.8 | Dec 5 | QNAP Photo Station Improper Access Control Vulnerability Affected: before 6.0.3; before 5.7.10; before 5.4.9; before 5.2.11 |
| CVE-2022-27593 RansomwareIn wildKEV | 9.1 | Sep 8 | DeadBolt Ransomware Affected: before 5.2.14; before 5.4.15; before 5.7.18; before 6.0.22; before 6.1.2 |
| CVE-2017-20210 | 9.8 | Nov 11 | Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research Affected: 5.2.7; 5.4.1 |
| CVE-2021-44057 | 9.8 | May 5 | An improper authentication vulnerability has been reported to affect QNAP device running Photo Station Affected: before 5.4.13; 5.6.0 before 5.7.16; 6.0.0 before 6.0.20 |
| CVE-2023-47562 | 8.8 | Feb 2 | An OS command injection vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.2 |
| CVE-2018-0722 | 7.5 | Feb 1 | Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers… Affected: Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 |
| CVE-2020-2502 | 6.1 | Feb 17 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code Affected: before 6.0.11 |
| CVE-2020-2491 | 6.1 | Dec 10 | This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code Affected: before 6.0.12; before 6.0.12; before 5.7.12; before 5.7.13; before 5.4.10; before 5.2.11 |
| CVE-2018-19956 | 6.1 | Nov 2 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station Affected: 5.7.0 before 5.7.11; 6.0.0 before 6.0.10 |
| CVE-2018-19955 | 6.1 | Nov 2 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station Affected: 5.7.0 before 5.7.11; 6.0.0 before 6.0.10 |
| CVE-2018-19954 | 6.1 | Nov 2 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station Affected: 5.7.0 before 5.7.11; 6.0.0 before 6.0.10 |
| CVE-2018-0715 | 6.1 | Aug 27 | Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application Affected: through 5.7.0 |
| CVE-2017-13073 | 6.1 | Apr 23 | Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary… Affected: 5.2.0 through 5.2.7; 5.4.0 through 5.4.3 |
| CVE-2024-12923 | 5.4 | Aug 29 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.5 |
| CVE-2024-32770 | 5.4 | Nov 22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3 |
| CVE-2024-32769 | 5.4 | Nov 22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3 |
| CVE-2024-32768 | 5.4 | Nov 22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3 |
| CVE-2024-32767 | 5.4 | Nov 22 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3 |
| CVE-2023-47561 | 5.4 | Feb 2 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.2 |
| CVE-2021-34356 | 5.4 | Oct 1 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station Affected: before 6.0.18 |
| CVE-2021-34355 | 5.4 | Oct 1 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station Affected: before 5.4.10; 5.7.0 before 5.7.13; 6.0.0 before 6.0.18 |
| CVE-2021-34354 | 5.4 | Oct 1 | A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station Affected: before 6.0.18 |
| CVE-2023-47221 | 4.9 | Mar 8 | A path traversal vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.2 |
| CVE-2013-5760 | – | Jun 9 | QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php Affected: All versions, or not specified |
Showing 26