vulnerability
QNAP QTS: CVE-2021-28806: DOM-Based XSS Vulnerability in QTS and QuTS hero
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 3 | (AV:N/AC:M/Au:S/C:N/I:P/A:N) | Jun 3, 2021 | Aug 4, 2025 | Oct 16, 2025 |
Severity
3
CVSS
(AV:N/AC:M/Au:S/C:N/I:P/A:N)
Published
Jun 3, 2021
Added
Aug 4, 2025
Modified
Oct 16, 2025
Description
A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. We have already fixed this vulnerability in the following versions: QTS 4.5.3.1652 Build 20210428 and later QuTS hero h4.5.2.1638 Build 20210414 and later QuTScloud c4.5.5.1656 Build 20210503 and later QNAP NAS running QTS 4.3.6 and QTS 4.3.3 are not affected.
Solution
qnap-qts-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.