CVE-2026-26244
A SQL injection vulnerability has been reported to affect Video Station.
Published Oct 15, 2026 · updated Oct 15, 2026 · QNAP Systems Inc. Video Station
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Oct 15, 2026 · NIST NVD
Updated
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Oct 15, 2026 · NIST NVD
Updated
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Affected
- vendor QNAP Systems Inc. Video Stationversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-26244
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-26244
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-26244
30-day exploitation probability 0.4%
first.org - NIST NVDVulnerability recordCVE-2026-26244
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5
nvd.nist.gov