CVE-2018-19954: QNAP Photo Station

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.

Affected products

• QNAP Photo Station: from 5.7.0, before 5.7.11 (fixed in 5.7.11); from 6.0.0, before 6.0.10 (fixed in 6.0.10)

Published 2020-11-02. Last modified 2026-06-17.