CVE-2018-19943

MediumCVSS 5.4/10Known exploited (CISA KEV)Last modified Aug 13, 2026

Description

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	QTS	>= unspecified, < 4.4.2.1270
QNAP Systems Inc.	QTS	>= unspecified, < 4.4.1.1261; >= unspecified, < 4.3.6.1263
QNAP Systems Inc.	QTS	>= unspecified, < 4.3.4.1282
QNAP Systems Inc.	QTS	>= unspecified, < 4.3.3.1252
QNAP Systems Inc.	QTS	>= unspecified, < 4.2.6

References

https://www.qnap.com/zh-tw/security-advisory/qsa-20-01Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-20-01Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943US Government Resource

Timeline

Published: Oct 28, 2020
Last modified: Aug 13, 2026
Added to CISA KEV: May 24, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-199447.5A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerab CVE-2018-199459.1A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to CVE-2018-199465.9The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerabilit CVE-2018-199476.5The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could dis CVE-2018-199486.5The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerabil CVE-2018-199499.8If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue CVE-2018-199509.8If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Syst CVE-2018-199516.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP System CVE-2018-199527.5If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Syst CVE-2018-199536.1If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issu CVE-2018-199546.1The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could CVE-2018-199556.1The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could