CVE-2025-54161

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource.

We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5068 and later

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-541624.9A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can the CVE-2025-541634.9A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, th CVE-2025-541644.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an admini CVE-2025-541654.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an admini CVE-2025-541664.9An out-of-bounds read vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an admini CVE-2025-541677.2A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator acco CVE-2025-541684.8A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If a remote attacker gains an administrator account, th CVE-2025-541696.5An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exp CVE-2025-54176.1An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Develop CVE-2025-541706.5An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then expl CVE-2025-541724.8QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject a CVE-2025-541744.3QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality. Malicious attacker can craft special website, which