{"id":"CVE-2019-7197","aliases":["EUVD-2019-16741","GHSA-f8vw-827h-ffmp"],"status":"published","title":"A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions...","description":"A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01152,"percentile":0.67167,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2019-12-04T16:45:00Z","modified":"2026-06-17T02:40:14Z","products":[{"vendor":"qnap","product":"qts"}],"references":[{"url":"https://www.qnap.com/zh-tw/security-advisory/nas-201911-26","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7197"},{"url":"https://github.com/advisories/GHSA-f8vw-827h-ffmp"}],"sources":{"cve":[{"id":"CVE-2019-7197","description":"A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.","status":"published","published":"2019-12-04T16:45:00Z","modified":"2024-08-04T20:38:33.491Z","updated_at":"2026-11-02T14:32:22.432545Z"}],"euvd":[{"id":"EUVD-2019-16741","description":"A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.","status":"published","published":"2019-12-04T16:45:00Z","modified":"2024-08-04T20:38:33Z","updated_at":"2026-11-03T03:06:46.489173Z"}],"ghsa":[{"id":"GHSA-f8vw-827h-ffmp","title":"A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions...","description":"A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.","status":"published","published":"2022-05-24T17:02:42Z","modified":"2023-01-28T05:08:31Z","updated_at":"2026-11-02T14:44:37.39101Z"}],"nvd":[{"id":"CVE-2019-7197","description":"A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, this vulnerability may allow an attacker to inject and execute scripts on the administrator console. To fix this vulnerability, QNAP recommend updating QTS to the latest version.","status":"published","published":"2019-12-04T17:16:44.447Z","modified":"2026-06-17T02:40:14.803Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:38.993437Z"}]}}