QNAP NAS File Station Cross-Site Scripting Vulnerability

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

• cpe qnap/qts4.2.6
• vendor QNAP Network Attached Storage (NAS)version unspecified
• vendor QNAP QNAP Network-Attached Storage (NAS)version unspecified

How to fix CVE-2018-19943

• Recommended remediation

  Apply updates per vendor instructions. CISA due date Jun 14, 2022.

• Official advisories

  • CISA KEV · cisa.gov
  • CVE.org · cve.org
  • FIRST EPSS · first.org
  • NIST NVD · nvd.nist.gov
  • VulnCheck KEV · vulncheck.com

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Oct 28, 2020 · Catalog

   Detected

   If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421

2. May 24, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Jun 14, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Aug 12, 2026 · Catalog

   Updated

   If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421

Sources

• CISA KEVConfirmed exploitationCVE-2018-19943

  A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

  cisa.gov
• CVE.orgVulnerability recordCVE-2018-19943

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2018-19943

  30-day exploitation probability 21.5%

  first.org
• NIST NVDVulnerability recordCVE-2018-19943

  If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 202

  nvd.nist.gov
• VulnCheck KEVConfirmed exploitationCVE-2018-19943

  A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.

  vulncheck.com

References

• VulnCheck exploitation evidence · cybersecurityworks.com
• VulnCheck exploitation evidence · cybersecurityworks.com
• VulnCheck exploitation evidence · go.recordedfuture.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• VulnCheck exploitation evidence · cisa.gov
• Vendor Advisory · qnap.com

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.