Photo Station vulnerabilities | LiveThreat CVE Feed

Product

Photo Station

by QNAP · last CVE Nov 11, 2025

On CISA KEVExploited in the wildRansomware-linked

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities26 In the news0 Timeline

Severity mix

Critical 6High 2Medium 17Low 0

Severity

All severities26 Critical6 High2 Medium17 Low0

Exploitation

On CISA KEV4 Exploited in the wild4

Watch

Add Photo Station to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2020-2502	6.1	1%	Feb 17	This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code Affected: before 6.0.11
CVE-2020-2491	6.1	1%	Dec 10	This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code Affected: before 6.0.12; before 6.0.12; before 5.7.12; before 5.7.13; before 5.4.10; before 5.2.11
CVE-2018-19956	6.1	1%	Nov 2	The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station Affected: 5.7.0 before 5.7.11; 6.0.0 before 6.0.10
CVE-2018-19955	6.1	1%	Nov 2	The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station Affected: 5.7.0 before 5.7.11; 6.0.0 before 6.0.10
CVE-2018-19954	6.1	1%	Nov 2	The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station Affected: 5.7.0 before 5.7.11; 6.0.0 before 6.0.10
CVE-2018-0715	6.1	3%	Aug 27	Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application Affected: through 5.7.0
CVE-2017-13073	6.1	1%	Apr 23	Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary… Affected: 5.2.0 through 5.2.7; 5.4.0 through 5.4.3
CVE-2024-12923	5.4	0%	Aug 29	A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.5
CVE-2024-32770	5.4	0%	Nov 22	A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3
CVE-2024-32769	5.4	0%	Nov 22	A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3
CVE-2024-32768	5.4	0%	Nov 22	A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3
CVE-2024-32767	5.4	0%	Nov 22	A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.3
CVE-2023-47561	5.4	0%	Feb 2	A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.2
CVE-2021-34356	5.4	1%	Oct 1	A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station Affected: before 6.0.18
CVE-2021-34355	5.4	1%	Oct 1	A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station Affected: before 5.4.10; 5.7.0 before 5.7.13; 6.0.0 before 6.0.18
CVE-2021-34354	5.4	1%	Oct 1	A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station Affected: before 6.0.18
CVE-2023-47221	4.9	0%	Mar 8	A path traversal vulnerability has been reported to affect Photo Station Affected: 6.4.0 before 6.4.2