Photo Station (Qnap) - vulnerabilities (CVEs)

25 CVEs, 0 in the last 30 days, 95 known versions, newest CVE from 2025-11-11. Vendor: Qnap.

CVEs of Photo Station

• CVE-2017-20210 - CVSS 9.8 (critical), 2025-11-11: Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.
• CVE-2024-12923 - CVSS 5.4 (medium), 2025-08-29: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the…
• CVE-2024-32767 - CVSS 6.3 (medium), 2024-11-22: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have…
• CVE-2024-32770 - CVSS 6.3 (medium), 2024-11-22: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have…
• CVE-2024-32769 - CVSS 6.3 (medium), 2024-11-22: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have…
• CVE-2024-32768 - CVSS 6.3 (medium), 2024-11-22: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have…
• CVE-2023-47221 - CVSS 5.5 (medium), 2024-03-08: A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the…
• CVE-2023-47562 - CVSS 8.8 (high), 2024-02-02: An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute…
• CVE-2023-47561 - CVSS 5.5 (medium), 2024-02-02: A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to…
• CVE-2022-27593 - CVSS 10 (critical), 2022-09-08: An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an…
• CVE-2021-44057 - CVSS 9.8 (critical), 2022-05-05: An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to…
• CVE-2021-34356 - CVSS 7.6 (high), 2021-10-01: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote…
• CVE-2021-34355 - CVSS 7.6 (high), 2021-10-01: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote…
• CVE-2021-34354 - CVSS 7.6 (high), 2021-10-01: A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote…
• CVE-2020-2502 - CVSS 6.1 (medium), 2021-02-17: This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in…
• CVE-2020-2491 - CVSS 6.1 (medium), 2020-12-10: This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in…
• CVE-2018-19954 - CVSS 6.1 (medium), 2020-11-02: The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote…
• CVE-2018-19956 - CVSS 6.1 (medium), 2020-11-02: The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote…
• CVE-2018-19955 - CVSS 6.1 (medium), 2020-11-02: The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote…
• CVE-2019-7195 - CVSS 9.8 (critical), 2019-12-05: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend…
• CVE-2019-7194 - CVSS 9.8 (critical), 2019-12-05: This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend…
• CVE-2019-7192 - CVSS 9.8 (critical), 2019-12-05: This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend…
• CVE-2018-0722 - CVSS 7.5 (high), 2019-02-01: Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could…
• CVE-2018-0715 - CVSS 6.1 (medium), 2018-08-27: Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised…
• CVE-2017-13073 - CVSS 6.1 (medium), 2018-04-23: Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers…
• CVE-2013-5760 - CVSS 5 (medium), 2014-06-09: QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php.