CVE-2018-19943If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code.
Updated under an hour ago ()
Does this affect you?
It affects QNAP Systems Inc. QTS and 1 other product. Add what you run to find out whether that includes you.
CISA lists it as known exploited since May 24, 2022; federal agencies had to remediate by Jun 14, 2022, and it is known to be used in ransomware. Treat that date as your deadline.
Do this next
Free account, 1 product
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
- CVSS
- 8.0 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-79, CWE-80
- Known exploited
- Added to CISA KEV May 24, 2022; federal remediation due Jun 14, 2022; known ransomware useApply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 21.48% (percentile 98)
- Assigned by
- qnap
- NVD analysis
- Analyzed
- Record last updated
- Aug 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
QNAP Systems Inc. QTS qnap_systems:qts (from the name) | from unspecified before 4.4.2.1270 | CNA record |
qnap qts qnap:qts | before 4.2.6; from 4.3.1.0013 before 4.3.3.1252; from 4.3.4 before 4.3.4.1282; from 4.3.6 before 4.3.6.1263; from 4.4.0 before 4.4.1.1261; from 4.4.2 before 4.4.2.1270; 4.2.6; 4.2.6; and 8 more ranges | NVD |
References
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-01x-refsource-misc, vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.