Skip to content

QNAP · weakness class

SQL Injection

27 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

likely to be exploited
1

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. myQNAPcloudCVE-2024-21901QNAP Systems Inc. · CVSS 4.7 · 19% likely

    CWE-89

  2. SMB ServiceCVE-2024-50387QNAP Systems Inc. · CVSS 10 · 10.0% likely

    CWE-89

  3. Vulnerability in QTSCVE-2022-27596QNAP Systems Inc. · CVSS 9.8 · 2.7% likely

    CWE-89

  4. QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk application informat…CVE-2017-13068QNAP · 2.6% likely

    CWE-89

  5. SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-OnCVE-2020-36195QNAP Systems Inc. · CVSS 9.8 · 1.8% likely

    CWE-89

  6. QTS, QuTS heroCVE-2025-62849QNAP Systems Inc. · CVSS 5.2 · 1.0% likely

    CWE-89

  7. QuRouterCVE-2024-50389QNAP Systems Inc. · CVSS 9.5 · 0.8% likely

    CWE-89

  8. Hyper Data ProtectorCVE-2025-59389QNAP Systems Inc. · CVSS 8.1 · 0.7% likelycovered by CyberSIXT

    CWE-89

  9. QuMagieCVE-2023-41285QNAP Systems Inc. · CVSS 7.4 · 0.7% likely

    CWE-89

  10. QuMagieCVE-2023-41284QNAP Systems Inc. · CVSS 7.4 · 0.7% likely

    CWE-89

  11. Video StationCVE-2023-34976QNAP Systems Inc. · CVSS 10 · 0.6% likely

    CWE-89

  12. QTS, QuTS hero, QuTScloudCVE-2023-47568QNAP Systems Inc. · CVSS 8.8 · 0.5% likely

    CWE-89

  13. Video StationCVE-2023-41287QNAP Systems Inc. · CVSS 4.3 · 0.5% likely

    CWE-89

  14. Qsync CentralCVE-2025-29892QNAP Systems Inc. · CVSS 8.7 · 0.5% likely

    CWE-89

  15. QuMagieCVE-2023-47219QNAP Systems Inc. · CVSS 3.5 · 0.5% likely

    CWE-89

  16. Qsync CentralCVE-2025-29894QNAP Systems Inc. · CVSS 7.5 · 0.5% likely

    CWE-89

  17. Qsync CentralCVE-2025-29893QNAP Systems Inc. · CVSS 7.5 · 0.5% likely

    CWE-89

  18. Qsync CentralCVE-2025-54153QNAP Systems Inc. · CVSS 8.6 · 0.4% likely

    CWE-89

  19. Qsync CentralCVE-2025-53595QNAP Systems Inc. · CVSS 8.6 · 0.4% likely

    CWE-89

  20. Video StationCVE-2023-50360QNAP Systems Inc. · CVSS 8.8 · 0.4% likely

    CWE-89

  21. QuMagieCVE-2025-52425QNAP Systems Inc. · CVSS 9.5 · 0.4% likely

    CWE-89

  22. Video StationCVE-2024-56804QNAP Systems Inc. · CVSS 5.3 · 0.4% likely

    CWE-89

  23. SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffsetCVE-2026-26245QNAP Systems Inc. · CVSS 7.1 · 0.4% likely

    CWE-89

  24. SQLi#1 SQL Injection in class_videos.php _getFiltersCVE-2026-26244QNAP Systems Inc. · CVSS 7.1 · 0.4% likely

    CWE-89

  25. MARS (Multi-Application Recovery Service)CVE-2025-59387QNAP Systems Inc. · CVSS 8.1 · 0.4% likely

    CWE-89

  26. QuRouterCVE-2025-62846QNAP Systems Inc. · CVSS 7.3 · 0.2% likelycovered by CyberSIXT

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.