CVE-2017-13072: QNAP QTS

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.

Affected products

• QNAP QTS: version 4.2.6 only; version 4.3.3 only; version 4.3.4 only

Published 2018-06-21. Last modified 2026-06-17.