{"id":"CVE-2018-19953","title":"If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code","summary":"If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 202001…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79","CWE-80"],"vendor":"qnap","product":"qts","affected":["qts < 4.2.6","qts >= 4.3.1.0013, < 4.3.3.1161","qts >= 4.3.4, < 4.3.4.1190","qts >= 4.3.6, < 4.3.6.1218","qts >= 4.4.0, < 4.4.1.1201","qts >= 4.4.2, < 4.4.2.1231","qts = 4.2.6"],"patched":["qts 4.4.2.1231"],"published":"2020-10-28","updated":"2026-10-01","sourceUpdated":"2026-10-01T20:17:17.020","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2018-19953","references":[{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-20-01","label":"security@qnapsecurity.com.tw"},{"url":"https://www.qnap.com/zh-tw/security-advisory/qsa-20-01","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19953","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","cve.org","exploit-available"],"epss":0.30527,"epssPercentile":0.98229,"kev":true,"kevDateAdded":"2022-05-24","kevDueDate":"2022-06-14","kevRansomware":true,"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-08-13T03:55:37.979267Z"},"ingestedAt":"2026-08-13T06:00:54.979Z","slug":"CVE-2018-19953","body":"## Overview\n\nIf exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.\n\n## Affected\n\n- `qts < 4.2.6`\n- `qts >= 4.3.1.0013, < 4.3.3.1161`\n- `qts >= 4.3.4, < 4.3.4.1190`\n- `qts >= 4.3.6, < 4.3.6.1218`\n- `qts >= 4.4.0, < 4.4.1.1201`\n- `qts >= 4.4.2, < 4.4.2.1231`\n- `qts = 4.2.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `qts 4.4.2.1231`","depth":"midnight","depthScore":70,"depthScoreParts":{"impact":33.6,"likelihood":6.1,"exploitation":25,"ransomware":5},"changes":[{"seq":214701,"id":"CVE-2018-19953","ts":1790888469463,"field":"zero_day","old":"true","new":"false"},{"seq":214664,"id":"CVE-2018-19953","ts":1790884801857,"field":"exploit_available","old":"false","new":"true"}]}