QNAP Download Station vulnerabilities

3 CVEs affecting QNAP Download Station, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-58465, published 2025-11-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-58463, published 2025-11-07. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents…
CVE-2024-38640, published 2024-09-06. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We…
CVE-2025-58465, published 2025-11-07. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security…