Description
Cross-site scripting (XSS) vulnerability in QNAP NAS application Media Streaming add-on version 421.1.0.2, 430.1.2.0, and earlier allows remote attackers to inject arbitrary web script or HTML. The injected code will only be triggered by a crafted link, not the normal page.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.qnap.com/zh-tw/security-advisory/nas-201803-08
Scores
CVSS v3
6.1
EPSS
0.0025
EPSS Percentile
48.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
qnap/media_streaming_add-on
< 430.1.2.0
Published
Mar 08, 2018
Tracked Since
Feb 18, 2026