CVE WatchOct 1, 2026

CVE-2018-19953

QNAP NAS File Station Cross-Site Scripting Vulnerability

CVSS

6.1

Medium

EPSS

29.0%

p98

KEV

YES

May 24, 2022

Exploit Today

0-100

Published: Oct 28, 2020 · Last modified: Oct 1, 2026 · CWE-79 · CWE-80

EPSS · 30d

23.9%EPSS · 30 days29.0%

2026-09-162026-10-14

KEV catalog record

Product

QNAP / Network Attached Storage (NAS)

Vulnerability

QNAP NAS File Station Cross-Site Scripting Vulnerability

Added to KEV

May 24, 2022

Remediate by

Jun 14, 2022

Known ransomware use

Yes

Summary description

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-19953

Technical description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-63430—

—

———ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotation-xml, and at least one raw-text HTML element while disallowing the encoding attribute can permit mutation cross-site scripting. ammonia does not correctly implement annotation-xml's encoding-dependent MathML integration-point behavior after attribute filtering removes encoding, so the sanitizer validates a descendant under one namespace interpretation while the browser reparses the output under another. An attacker can use that namespace transition and an allowed raw-text HTML element to execute JavaScript when a user renders the sanitized output. The required tags are not enabled by default, so applications that do not explicitly allow them are not affected. This issue is fixed in versions 3.3.2, 4.0.2, and 4.1.3.5h CVE-2026-558728.7 HIG

—

———GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.5h CVE-2026-1112334.7 MED

—

———Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.5h CVE-2026-1112324.8 MED

—

———Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.5h CVE-2026-1111685.4 MED

—

———LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.5h CVE-2026-1108785.4 MED

—

———Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.5h