CVE WatchAug 13, 2026

CVE-2018-19943

QNAP NAS File Station Cross-Site Scripting Vulnerability

CVSS

8.0

High

EPSS

21.5%

p98

KEV

YES

May 24, 2022

Exploit Today

0-100

Published: Oct 28, 2020 · Last modified: Aug 13, 2026 · CWE-79 · CWE-80

EPSS · 30d

17.7%EPSS · 30 days21.5%

2026-09-162026-10-14

KEV catalog record

Product

QNAP / Network Attached Storage (NAS)

Vulnerability

QNAP NAS File Station Cross-Site Scripting Vulnerability

Added to KEV

May 24, 2022

Remediate by

Jun 14, 2022

Known ransomware use

Yes

Summary description

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-19943

Technical description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1097027.1 HIG

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31.5h CVE-2026-1096857.1 HIG

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7.5h CVE-2026-1058826.5 MED

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.5h CVE-2026-1084987.1 HIG

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.7h CVE-2026-1084917.1 HIG

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.7h CVE-2026-47790—

—

———A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later8h