CVE-2025-22483

MediumCVSS 4.8/10Last modified Oct 18, 2026

Description

A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions: License Center 1.8.51 and later License Center 1.9.51 and later

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
QNAP Systems Inc.	License Center	>= 1.8.x, < 1.8.51; >= 1.9.x, < 1.9.51

References

https://www.qnap.com/en/security-advisory/qsa-25-27Vendor Advisory

Timeline

Published: Aug 29, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-224847.1An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gain CVE-2025-224868.8An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow rem CVE-2025-22498.8The SoJ SoundSlides plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the soj_soundslides_CVE-2025-224907.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can th CVE-2025-224916.7The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead in CVE-2025-224926.3The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for CVE-2025-224935.6Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the se CVE-2025-224958.4An improper input validation vulnerability was discovered in the NTP server configuration field of the Network-M2 card. This could result in CVE-2025-224965.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MarMar8x Notif Bell notif-bell allows CVE-2025-224976.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bramwaas Simple Google Calendar Outloo CVE-2025-224987.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N3wNormal LucidLMS lucidlms allows Ref CVE-2025-224997.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FAKTOR VIER F4 Post Tree f4-tree allow