Live › vulnerability › CVE-2018-19943
Go to dashboardQNAP NAS File Station has a cross-site scripting flaw that lets remote attackers inject malicious script. An attacker can run script in a logged-in user's browser session on the NAS web interface, which the sources tie to ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| QNAP Network Attached Storage (NAS) | vendor | – | – |
Confirm the NAS model and firmware version under Control Panel > System in the QNAP web UI; the sources do not give affected version ranges.
Apply the QNAP firmware and File Station updates per the vendor instructions referenced by CISA; the sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
This page as .md · .json · in your agent: get_signal("CVE-2018-19943")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.