CVE-2025-54167: QNAP Systems Inc Notification Center

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: Notification Center 2.1.0.3443 and later Notification Center 1.9.2.3163 and later Notification Center 3.0.0.3466 and later

Affected products

• QNAP Systems Inc Notification Center: from 2.1, before 2.1.0.3443 (fixed in 2.1.0.3443); from 1.9, before 1.9.2.3163 (fixed in 1.9.2.3163); from 3.0, before 3.0.0.3466 (fixed in 3.0.0.3466)

Published 2025-11-07. Last modified 2026-06-17.