If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.

published 2020-10-28 6 y ago modified 2026-08-13 2 mo ago also EUVD-2018-11614

cvss: 8.0; version 3.1, CNA
cisa kev: Exploited; added 2022-05-24, used in ransomware
epss: 22.7%; EPSS 22.7% chance of exploitation in 30 days, percentile 97%
public exploits: 0; none known

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

QNAP Systems Inc. QTS 4.2.6, 4.3.3.1252, 4.3.4.1282, 4.3.6.1263, 4.4.1.1261, 4.4.2.1270

Timeline

2020-10-28 Published
2022-05-24 Added to CISA KEV
2022-06-01 CISA SSVC: exploitation active
2022-06-14 CISA patch deadline

Known exploited

Added: 4 y ago (2022-05-24)
Patch by: 2022-06-14 (4 y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: QNAP, Network Attached Storage (NAS)
CISA name: QNAP NAS File Station Cross-Site Scripting Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 4 y ago (2022-06-01)

Exploit prediction

22.68% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.0	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	3.5	AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

QNAP Systems Inc. QTS

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page

References

qnap.com /zh-tw/security-advisory/qsa-20-01
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943
government-resource, us-government-resource

Sources

CVE List CVE-2018-19943
NVD CVE-2018-19943

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary