Synology Drive Server vulnerabilities

6 CVEs affecting Synology Drive Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-50631, published 2025-03-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-50631, published 2025-03-19. High severity, CVSS 7.5. EPSS: 26.2% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085…
CVE-2024-50630, published 2025-03-19. High severity, CVSS 7.5. EPSS: 24.6% chance of exploitation in the next 30 days. Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to…
CVE-2018-13297, published 2019-04-01. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system information via the dsm_path parameter.
CVE-2018-8922, published 2018-06-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecified vectors.
CVE-2018-8910, published 2018-05-10. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Drive before 1.0.1-10253 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments.
CVE-2018-8921, published 2018-06-01. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious…