CVE-2025-30269

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data or modify memory.

We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-134

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-30276.1The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the s CVE-2025-302706.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account CVE-2025-302716.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account CVE-2025-302726.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulner CVE-2025-302738.1An out-of-bounds write vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user a CVE-2025-302746.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If can then exploit the vulner CVE-2025-302756.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-302768.8An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exp CVE-2025-302778.8An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they CVE-2025-302788.8An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they CVE-2025-302798.8An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, the CVE-2025-30286.5JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in