Known vulnerabilities in Photo Station

Software: Photo Station
Software CPE: cpe:2.3:a:qnap_systems:photo_station:*:*:*:*:*:*:*:*
Total vulnerabilities: 19
Public exploits: 5
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Photo Station Photo Station is affected by 19 known vulnerabilities: 1 critical, 4 high, 2 medium, 12 low Critical High Medium Low

Vulnerabilities (19)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU114589 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-12923
CWE-79 Low
No
No
6.4.5 01.09.2025 SB2025090110
#VU100881 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-32770
CWE-79 Low
No
No
6.4.3 25.11.2024 SB2024112520
#VU100880 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-32769
CWE-79 Low
No
No
6.4.3 25.11.2024 SB2024112520
#VU100879 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-32768
CWE-79 Low
No
No
6.4.3 25.11.2024 SB2024112520
#VU100878 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-32767
CWE-79 Low
No
No
6.4.3 25.11.2024 SB2024112520
#VU87315 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-47221
CWE-22 Low
No
No
6.4.2 11.03.2024 SB2024031101
#VU86055 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-47562
CWE-78 Medium
No
No
6.4.2 05.02.2024 SB2024020510
#VU86054 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-47561
CWE-79 Low
No
No
6.4.2 05.02.2024 SB2024020510
#VU66993 - Improper input validation
CVE-2022-27593
CWE-20 Critical
Available
Exploited
5.2.14, 5.4.15, 5.7.18, 6.0.22, 6.1.2 06.09.2022 SB2022090612
#VU62835 - Improper Authentication
CVE-2021-44057
CWE-287 Medium
No
No
4.5.13, 5.7.16, 6.0.20 06.05.2022 SB2022050602
#VU57001 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-34356
CWE-79 Low
No
No
6.0.18 01.10.2021 SB2021100110
#VU57000 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-34354
CWE-79 Low
No
No
6.0.18 01.10.2021 SB2021100110
#VU56999 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-34355
CWE-79 Low
No
No
5.4.10, 5.7.13, 6.0.18 01.10.2021 SB2021100110
#VU56457 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79 Low
No
No
6.0.18 13.09.2021 SB2021091303
#VU50760 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-2502
CWE-79 Low
No
No
6.0.11 17.02.2021 SB2021021704
#VU28117 - Externally Controlled Reference to a Resource in Another Sphere
CVE-2019-7195
CWE-610 High
Available
Exploited
5.2.11, 5.4.9, 5.7.10, 6.0.3 20.05.2020 SB2019122502
#VU28116 - Externally Controlled Reference to a Resource in Another Sphere
CVE-2019-7194
CWE-610 High
Available
Exploited
5.2.11, 5.4.9, 5.7.10, 6.0.3 20.05.2020 SB2019122502
#VU28115 - Improper input validation
CVE-2019-7193
CWE-20 High
Available
Exploited
5.2.11, 5.4.9, 5.7.10, 6.0.3 20.05.2020 SB2019122502
#VU28114 - Improper Access Control
CVE-2019-7192
CWE-284 High
Available
Exploited
5.2.11, 5.4.9, 5.7.10, 6.0.3 20.05.2020 SB2019122502