ZeroDay Findings
Sign inSign up

Findings

CVE-2018-19943

QNAP NAS File Station Cross-Site Scripting Vulnerability

Published Oct 28, 2020 · updated Aug 12, 2026 · qnap qts

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Timeline

Detection, updates, and resolution for this record.

  1. Oct 28, 2020 · Catalog

    Detected

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421

  2. May 24, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jun 14, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 12, 2026 · Catalog

    Updated

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421

Required action

Apply updates per vendor instructions.

CISA due date Jun 14, 2022

Affected

  • cpe qnap/qtsversion unspecified
  • cpe qnap/qts4.2.6
  • vendor QNAP Network Attached Storage (NAS)version unspecified

Sources

  • CISA KEVCVE-2018-19943

    A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

    cisa.gov
  • CVE.orgCVE-2018-19943

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-19943

    30-day exploitation probability 21.5%

    first.org
  • NIST NVDCVE-2018-19943

    If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 202

    nvd.nist.gov

References