Quftp Service
Monthly
Authenticated cross-site scripting in QNAP's QuFTP Service allows a remote attacker who already holds a valid QuFTP user account to inject malicious script that executes in a victim's browser within the NAS web interface, potentially compromising the wider session context rather than the FTP service alone. The flaw affects QuFTP Service installations on QNAP NAS devices in branches prior to 1.4.6, 1.5.5, and 1.6.5, and successful exploitation additionally requires a victim to view the injected content. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the mandatory account prerequisite plus the user-interaction requirement are the principal limiters on real-world risk.
A cross-site scripting (XSS) vulnerability exists in QuFTP Service that allows authenticated remote attackers with administrator credentials to bypass security mechanisms and read application data. The vulnerability affects multiple versions of QuFTP Service across different release branches (1.4.x, 1.5.x, and 1.6.x prior to specified patch versions). While no CVSS score, EPSS probability, or KEV status is currently available, the requirement for administrator-level access significantly constrains real-world exploitation risk.
Authenticated cross-site scripting in QNAP's QuFTP Service allows a remote attacker who already holds a valid QuFTP user account to inject malicious script that executes in a victim's browser within the NAS web interface, potentially compromising the wider session context rather than the FTP service alone. The flaw affects QuFTP Service installations on QNAP NAS devices in branches prior to 1.4.6, 1.5.5, and 1.6.5, and successful exploitation additionally requires a victim to view the injected content. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the mandatory account prerequisite plus the user-interaction requirement are the principal limiters on real-world risk.
A cross-site scripting (XSS) vulnerability exists in QuFTP Service that allows authenticated remote attackers with administrator credentials to bypass security mechanisms and read application data. The vulnerability affects multiple versions of QuFTP Service across different release branches (1.4.x, 1.5.x, and 1.6.x prior to specified patch versions). While no CVSS score, EPSS probability, or KEV status is currently available, the requirement for administrator-level access significantly constrains real-world exploitation risk.