CVE-2021-28807

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	Q’center	>= unspecified, < v1.12.1012
QNAP Systems Inc.	Q’center	>= unspecified, < v1.10.1004
QNAP Systems Inc.	Q’center	>= unspecified, < v1.10.1004
QNAP Systems Inc.	Q’center	>= unspecified, < v1.12.1012
QNAP Systems Inc.	Q’center	>= unspecified, < v1.12.1012

References

https://www.qnap.com/zh-tw/security-advisory/qsa-21-20Vendor Advisory
https://www.shielder.it/advisories/qnap-qcenter-post-auth-remote-code-execution-via-qpkg/Exploit, Third Party Advisory
https://www.shielder.it/advisories/qnap-qcenter-virtual-stored-xss/Exploit, Third Party Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-21-20Vendor Advisory
https://www.shielder.it/advisories/qnap-qcenter-post-auth-remote-code-execution-via-qpkg/Exploit, Third Party Advisory
https://www.shielder.it/advisories/qnap-qcenter-virtual-stored-xss/Exploit, Third Party Advisory

Timeline

Published: Jun 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-288099.8An improper access control vulnerability has been reported to affect certain legacy versions of HBS 3. If exploited, this vulnerability allo CVE-2021-288107.5If exploited, this vulnerability allows an attacker to access resources which are not otherwise accessible without proper authentication. Ro CVE-2021-288117.2If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this CVE-2021-288128.8A command injection vulnerability has been reported to affect certain versions of Video Station. If exploited, this vulnerability allows rem CVE-2021-288137.5A vulnerability involving insecure storage of sensitive information has been reported to affect QSW-M2116P-2T2S and QNAP switches running Qu CVE-2021-288148.8An improper access control vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows remote attackers to c CVE-2021-288154.9Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability al CVE-2021-288168.8A stack buffer overflow vulnerability has been reported to affect QNAP device running QTS, QuTScloud, QuTS hero. If exploited, this vulnerab CVE-2021-288177.8The Windows Installation component of TIBCO Software Inc.'s TIBCO Rendezvous and TIBCO Rendezvous Developer Edition contains a vulnerability CVE-2021-288187.8The Rendezvous Routing Daemon (rvrd), Rendezvous Secure Routing Daemon (rvrsd), Rendezvous Secure Daemon (rvsd), Rendezvous Cache (rvcache),CVE-2021-288197.8The Windows Installation component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - En CVE-2021-288207.8The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Com