CVE-2013-5760

QNAP Photo Station < 4.0.3 - Unauthenticated Exposure of Sensitive Information via list.php

Title source: llm

QNAP Photo Station before firmware 4.0.3 build0912 allows remote attackers to list OS user accounts via a request to photo/p/api/list.php.

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

Exploit x_refsource_misc

EPSS 0.0025

EPSS Percentile 48.3%

CWE

CWE-200

Status published

Products (2)

qnap/photo_station

qnap/photo_station_firmware < 4.0.3

Published Jun 09, 2014

Tracked Since Feb 18, 2026