{"id":"CVE-2017-13072","aliases":["EUVD-2017-4590","GHSA-9jm2-65cq-2572"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3...","description":"Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00772,"percentile":0.55932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-06-21T13:00:00Z","modified":"2026-06-17T01:04:28Z","products":[{"vendor":"qnap","product":"app center in qts"},{"vendor":"qnap","product":"qts"}],"references":[{"url":"https://www.qnap.com/en/security-advisory/nas-201805-16","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13072"},{"url":"https://github.com/advisories/GHSA-9jm2-65cq-2572"}],"sources":{"cve":[{"id":"CVE-2017-13072","description":"Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.","status":"published","published":"2018-06-21T13:00:00Z","modified":"2024-09-16T16:18:40.8Z","updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-4590","description":"Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.","status":"published","published":"2018-06-21T13:00:00Z","modified":"2024-09-16T16:18:40Z","updated_at":"2026-11-03T00:55:52.590586Z"}],"ghsa":[{"id":"GHSA-9jm2-65cq-2572","title":"Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3...","description":"Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.","status":"published","published":"2022-05-14T03:08:35Z","modified":"2023-02-02T05:07:19Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:52:28.437617Z"}],"nvd":[{"id":"CVE-2017-13072","description":"Cross-site scripting (XSS) vulnerability in App Center in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20171213, QTS 4.3.4 build 20171223, and their earlier versions could allow remote attackers to inject Javascript code.","status":"published","published":"2018-06-21T13:29:00.273Z","modified":"2026-06-17T01:04:28.853Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:18.679411Z"}]}}