QT
Product
QTS
On CISA KEVExploited in the wildRansomware-linked
283
CVEs
7
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 43High 115Medium 120Low 3
Watch
Add QTS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-2497 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in System Connection Logs Affected: before 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 |
| CVE-2020-2496 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station Affected: before 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 |
| CVE-2020-2495 | 6.1 | Dec 10 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station Affected: before 4.5.1.1456; before 4.4.3.1354; before 4.3.6.1333; before 4.3.4.1368; before 4.3.3.1315; before 4.2.6 |
| CVE-2018-0716 | 6.1 | Nov 30 | Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central 3.0.3, QTS 4.3.5: Qsync Central 3.0.4 and earlier versions… Affected: 4.2.6; 4.3.3; 4.3.4; 4.3.5 |
| CVE-2017-13072 | 6.1 | Jun 21 | Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow… Affected: 4.2.6; 4.3.3; 4.3.4 |
| CVE-2018-0711 | 6.1 | Apr 30 | Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary… Affected: 4.3.3.0514; 4.3.3.0546; 4.3.3.0570; 4.3.4.0516; 4.3.4.0526; 4.3.4.0551; +6 more |
| CVE-2017-7632 | 6.1 | Mar 27 | Cross-site scripting (XSS) vulnerability in File Station of QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to inject arbitrary web… Affected: 4.2.6; 4.3.3 |
| CVE-2017-7631 | 6.1 | Mar 27 | Cross-site scripting (XSS) vulnerability in the share link function of File Station of QNAP 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to… Affected: 4.2.6; 4.3.3 |
| CVE-2015-5664 | 6.1 | Jul 3 | Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 4.1.4 |
| CVE-2023-50358 | 5.8 | Feb 13 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions Affected: 4.2.0 before 4.2.6; 4.3.0 before 4.3.3.2644; 4.3.4 before 4.3.4.2675; 4.3.5 before 4.3.6.2665; 4.5.1 before 4.5.4.2627; 5.1.0 before 5.1.5.2645; +18 more |
| CVE-2024-50405 | 5.5 | Mar 7 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +3 more |
| CVE-2018-0719 | 5.5 | Nov 27 | Cross-site Scripting (XSS) vulnerability in NAS devices of QNAP Systems Inc Affected: 4.2.6; 4.3.3; 4.3.4 |
| CVE-2024-56805 | 5.4 | Jun 6 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +5 more |
| CVE-2024-21897 | 5.4 | Sep 6 | QTS, QuTS hero Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +5 more |
| CVE-2021-28806 | 5.4 | Jun 3 | A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero Affected: before 4.5.3.1652 |
| CVE-2024-48866 | 5.3 | Dec 6 | An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions Affected: 5.1.0.2348; 5.1.0.2399; 5.1.0.2418; 5.1.0.2444; 5.1.0.2466; 5.1.1.2491; +16 more |
| CVE-2023-34973 | 5.3 | Aug 24 | An insufficient entropy vulnerability has been reported to affect QNAP operating systems Affected: 5.0.1 before 5.0.1.2425; 5.1.0 before 5.1.0.2444 |
| CVE-2021-38693 | 5.3 | May 5 | A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance Affected: before 4.5.4.1991; 5.0.0.1716 before 5.0.0.1986 |
| CVE-2017-7630 | 5.3 | Mar 27 | QNAP QTS 4.2.6 build 20171026, QTS 4.3.3 build 20170727 and earlier allows remote attackers to obtain potentially sensitive information (firmware version and running services) via… Affected: 4.2.6; 4.3.3 |
| CVE-2025-47205 | 4.9 | Feb 11 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +12 more |
| CVE-2025-58466 | 4.9 | Feb 11 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +13 more |
| CVE-2025-59381 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +12 more |
| CVE-2025-59380 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +12 more |
| CVE-2025-57705 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-54166 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-54165 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-54164 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53596 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53590 | 4.9 | Jan 2 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53589 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53414 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-53405 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-52431 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-52430 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-52426 | 4.9 | Jan 2 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +10 more |
| CVE-2025-52866 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52862 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52860 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52859 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52858 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52857 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52855 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52854 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52853 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52433 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52432 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52428 | 4.9 | Oct 3 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52427 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-52424 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |
| CVE-2025-48729 | 4.9 | Oct 3 | QTS, QuTS hero Affected: 5.2.0.2737; 5.2.0.2744; 5.2.0.2782; 5.2.0.2802; 5.2.0.2823; 5.2.0.2851; +8 more |