CVE-2023-47218

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.

We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-77 CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-472198.8A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject CVE-2023-47225.5Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-472206.6An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authen CVE-2023-472214.9A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administ CVE-2023-472229.8An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could CVE-2023-472234.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions.CVE-2023-472247.5Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels CVE-2023-472255.4Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security L CVE-2023-472264.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin <= 1.0.20 version CVE-2023-472274.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Social Feed | All social media in one place plugin <= 1.5.4.6 CVE-2023-472284.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.CVE-2023-472295.4Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vyas Dipen Top 25 Social Icons plugin <= 3.1 versions.