{"schemaVersion":3,"id":"CVE-2018-19943","aliases":[],"status":"published","duplicateOf":null,"title":"QNAP NAS File Station Cross-Site Scripting Vulnerability","description":"If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later","dates":{"published":"2020-10-28T17:55:18.000Z","modified":"2026-08-13T03:55:39.524Z","reserved":null,"kevAdded":["2022-05-24T00:00:00.000Z"],"kevDue":["2022-06-14T00:00:00.000Z"]},"cvss":{"headline":{"score":8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":3.5,"severity":"low","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.21476,"percentile":0.97598,"severity":"high","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":3.7709999999999995,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.17705},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.21476,"percentile":0.97598}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.17705,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.21476,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.21476,"percentile":0.97598}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-24T00:00:00.000Z","dueDate":"2022-06-14T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"QNAP NAS File Station Cross-Site Scripting Vulnerability","description":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-19943","label":"nvd.nist.gov/vuln/detail/CVE-2018-19943"}],"vendor":"QNAP","product":"Network Attached Storage (NAS)","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-24T00:00:00.000Z","dueDate":"2022-06-14T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"QNAP NAS File Station Cross-Site Scripting Vulnerability","description":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-19943","label":"nvd.nist.gov/vuln/detail/CVE-2018-19943"}],"vendor":"QNAP","product":"Network Attached Storage (NAS)","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as \"<\", \">\", and \"&\" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/80.html"}],"affected":[{"vendor":"qnap systems inc.","product":"qts","name":"QTS","label":"qts","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 4.4.2.1270","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 4.4.1.1261","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 4.3.6.1263","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 4.3.4.1282","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 4.3.3.1252","noFixRecorded":false,"fixedIn":null},{"text":"≥ unspecified, < 4.2.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 4.4.2.1270 | ≥ unspecified, < 4.4.1.1261 | ≥ unspecified, < 4.3.6.1263 | ≥ unspecified, < 4.3.4.1282 | ≥ unspecified, < 4.3.3.1252 | ≥ unspecified, < 4.2.6","eol":null,"hubHref":"/vendor/qnap_systems_inc/qts"},{"vendor":"qnap","product":"qts","name":"QTS","label":"qts","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 4.2.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.3.1.0013, < 4.3.3.1252","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.3.4, < 4.3.4.1282","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.3.6, < 4.3.6.1263","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.4.0, < 4.4.1.1261","noFixRecorded":false,"fixedIn":null},{"text":"≥ 4.4.2, < 4.4.2.1270","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20170517","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20190322","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20190730","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20190921","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20191107","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20200109","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20200421","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20200611","noFixRecorded":false,"fixedIn":null},{"text":"4.2.6:build_20200821","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.2.6 | ≥ 4.3.1.0013, < 4.3.3.1252 | ≥ 4.3.4, < 4.3.4.1282 | ≥ 4.3.6, < 4.3.6.1263 | ≥ 4.4.0, < 4.4.1.1261 | ≥ 4.4.2, < 4.4.2.1270 | 4.2.6 | 4.2.6:build_20170517 | 4.2.6:build_20190322 | 4.2.6:build_20190730 | 4.2.6:build_20190921 | 4.2.6:build_20191107 | 4.2.6:build_20200109 | 4.2.6:build_20200421 | 4.2.6:build_20200611 | 4.2.6:build_20200821","eol":null,"hubHref":"/vendor/qnap/qts"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-20-01","label":"www.qnap.com/zh-tw/security-advisory/qsa-20-01","hostname":"www.qnap.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-10-28T17:55:18.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-05-24T00:00:00.000Z","label":"Added to CISA KEV","detail":"QNAP NAS File Station Cross-Site Scripting Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-14T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2026-08-13T03:55:39.524Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T00:23:47.534Z","stale":false,"partial":false}}