{"schemaVersion":3,"id":"CVE-2020-2502","aliases":[],"status":"published","duplicateOf":null,"title":"Cross-site Scripting Vulnerability in Photo Station","description":"This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later","dates":{"published":"2021-02-17T03:25:14.261Z","modified":"2024-09-16T23:06:30.137Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00827,"percentile":0.57015,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.00827},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00827,"percentile":0.57015}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00827,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.00827,"percentile":0.57015}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-80","name":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as \"<\", \">\", and \"&\" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/80.html"}],"affected":[{"vendor":"qnap systems inc.","product":"photo station","name":"Photo Station","label":"photo station","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 6.0.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 6.0.11","eol":null,"hubHref":"/vendor/qnap_systems_inc/photo_station"},{"vendor":"qnap","product":"photo_station","name":"Photo Station","label":"photo_station","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.0.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.0.11","eol":null,"hubHref":"/vendor/qnap/photo_station"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.qnap.com/en/security-advisory/qsa-21-06","label":"www.qnap.com/en/security-advisory/qsa-21-06","hostname":"www.qnap.com","tags":["X Refsource MISC","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-02-17T03:25:14.261Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T23:06:30.137Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T16:55:21.217Z","stale":false,"partial":false}}