CVE Watch1 de out. de 2026

CVE-2018-19953

QNAP NAS File Station Cross-Site Scripting Vulnerability

CVSS

6.1

Média

EPSS

30.5%

p98

KEV

SIM

24 de mai. de 2022

Exploit Today

0-100

Publicado: 28 de out. de 2020 · Última mod.: 1 de out. de 2026 · CWE-79 · CWE-80

EPSS · 30d

29.0%EPSS · 30 dias30.5%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

QNAP / Network Attached Storage (NAS)

Vulnerabilidade

QNAP NAS File Station Cross-Site Scripting Vulnerability

Adicionado ao KEV

24 de mai. de 2022

Corrigir até

14 de jun. de 2022

Uso conhecido em ransomware

Sim

Descrição resumida

A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

Ação necessária

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2018-19953

Descrição técnica

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-76580—

—

——0Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Cross-Site Scripting (XSS). This issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.6h CVE-2026-1039358.1 ALT

—

——0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form. Successful exploitation can expose session data and protected health information or permit patient-record actions in the victim's session. This issue is fixed in version 8.3.0.6h CVE-2026-1154526.7 MÉD

—

——0Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.6h CVE-2026-1079038.3 ALT

—

——0Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.06h CVE-2026-1056078.3 ALT

—

——0Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.06h CVE-2026-755995.4 MÉD

—

——0HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: URI that is rendered as a clickable anchor on an item page. When another authenticated user clicks the link, attacker-controlled JavaScript executes in the victim's HomeBox origin, enabling session theft, account takeover, or data exfiltration. This issue is fixed in version 0.27.0.9h