CVE-2015-5664

MEDIUM

QNAP QTS < 4.2.0 - Cross-Site Scripting in File Station

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References (4)

Core 4

Core References

Patch, Vendor Advisory x_refsource_confirm

https://www.qnap.com/i/en/support/con_show.php?cid=93

Vendor Advisory third-party-advisory x_refsource_jvn

http://jvn.jp/en/jp/JVN42930233/index.html

Vendor Advisory third-party-advisory x_refsource_jvndb

http://jvndb.jvn.jp/jvndb/JVNDB-2016-000119

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036123

Scores

CVSS v3 6.1

EPSS 0.0031

EPSS Percentile 54.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

qnap/qts < 4.1.4

Published Jul 03, 2016

Tracked Since Feb 18, 2026