CVE-2024-13086

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An exposure of sensitive information vulnerability has been reported to affect product. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.

We have already fixed the vulnerability in the following version: QTS 5.2.0.2851 build 20240808 and later QuTS hero h5.2.0.2851 build 20240808 and later

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
QNAP Systems Inc.QTS>= 5.x, < QTS 5.2.0.2851 build 20240808
QNAP Systems Inc.QuTS hero>= h5.x, < QuTS hero h5.2.0.2851 build 20240808

References

Timeline

Published
Mar 7, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-130876.7A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an adminCVE-2024-130887.8An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploitCVE-2024-130897.2An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitCVE-2024-13097.5Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affCVE-2024-130907.0A privilege escalation vulnerability may enable a service account to elevate its privileges. The sudo rules configured for a local servicCVE-2024-130919.8The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'qclCVE-2024-130927.5A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. This vulnerability affects unknown code of the file /CVE-2024-130937.5A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown procCVE-2024-130947.1The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2024-130954.8The WP Triggers Lite WordPress plugin through 2.5.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing adCVE-2024-130964.6The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whicCVE-2024-130975.4The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a R