CVE-2019-7197: QNAP QTS

Medium severity, CVSS 4.8. EPSS: 1.2% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.

Affected products

• QNAP QTS: version 4.2.6 only; version 4.3.3 only; version 4.3.4 only; version 4.3.6 only; version 4.4.1 only

Published 2019-12-04. Last modified 2026-06-17.