CVE-2026-41539Medium· 6.3▾ SunlitA cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have alrea…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data.
We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3500 build 20260520 and later
QTS >= 5.2.0 < 5.2.9.3492 build 20260507quts_hero >= h5.2.0 < h5.2.9.3499 build 20260514quts_hero >= h5.3.0 < h5.3.4.3500 build 20260520quts_hero >= ? < h6.0.0.3500 build 20260520We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3500 build 20260520 and later
Connected by shared product, vendor, weakness, or advisory.
CVE-2018-19943High· 8.0If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code
CVE-2018-19953Medium· 6.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code
CVE-2026-47790Medium· 6.3A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service
CVE-2026-39991Medium· 4.8A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3
CVE-2026-22896Medium· 6.2A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch
CVE-2024-38639Medium· 4.8An improper authentication vulnerability has been reported to affect product