QSearchQSearch

CVE-2026-41539

6.1 MEDIUM

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions

Published: 2026-06-09 · Last updated: 2026-06-12

Severity and scoring

CVSS
6.1 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
CWE-79

Affected products

VendorProduct
qnapqts, quts_hero

Description

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3500 build 20260520 and later

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-26241 — A buffer overflow vulnerability has been reported to affect File Station 5 (9.1 CRITICAL)
  • CVE-2026-26240 — A buffer overflow vulnerability has been reported to affect File Station 5 (9.1 CRITICAL)
  • CVE-2026-26239 — A buffer overflow vulnerability has been reported to affect File Station 5 (8.1 HIGH)
  • CVE-2026-26237 — A missing authorization vulnerability has been reported to affect QuMagie (7.5 HIGH)
  • CVE-2026-24724 — An incorrect authorization vulnerability has been reported to affect File Station 6 (8.1 HIGH)

Same CWE

  • CVE-2026-12176 — A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 (4.3 MEDIUM)
  • CVE-2026-5513 — The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '... (7.2 HIGH)
  • CVE-2026-9629 — The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including... (6.4 MEDIUM)
  • CVE-2026-3297 — The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anc... (6.4 MEDIUM)
  • CVE-2026-9134 — The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in ve... (6.4 MEDIUM)