CVE-2025-29892

CVE-2025-29892 concerns QNAP Qsync Central, where an SQL injection vulnerability could allow remote attackers with user access to execute unauthorized code or commands. Public details across sources confirm the issue originates from insufficient validation of externally entered SQL statements in ...

CVE-2024-50406 License Center

A cross-site scripting XSS vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version:...

CVE-2025-22481

CVE-2025-22481 is a remote command injection vulnerability affecting QNAP QTS and QuTS Hero. The issue is identified as improper neutralization of special elements used in a command, enabling remote attackers with user access to execute arbitrary commands. Affected products include QTS and QuTS H...

CVE-2024-56805 QTS, QuTS hero

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS...

CVE-2024-13087 QHora

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...

CVE-2025-22484 File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

CVE-2025-22490

CVE-2025-22490 affects QNAP File Station 5. Affected component: File Station 5 (versions prior to 5.5.6.4847). Root cause: NULL pointer dereference. Consequence: remote attacker who has a user account can trigger a denial-of-service (DoS) condition. Mitigation: update to File Station 5 5.5.6.4847...

CVE-2025-22490 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29872 File Station 5

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We ha...

CVE-2025-29873 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29876 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29876 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-30279 File Station 5

An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station ...

CVE-2025-33031 File Station 5

An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: File Station ...

OESA-2025-1603 assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fixes: An issue in assimp v.5.4.3 allows a...

PT-2025-23993 · Code Projects · Code-Projects Real Estate Property Management System

Name of the Vulnerable Software and Affected Versions: code-projects Real Estate Property Management System version 1.0 Description: A critical issue has been discovered, affecting the /Admin/NewsReport.php file. The txtFrom argument is vulnerable to sql injection, allowing for remote attacks. Th...

PT-2025-24233 · Implecode · Implecode Product Catalog Simple

Name of the Vulnerable Software and Affected Versions: impleCode Product Catalog Simple versions 1.8.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can...

PT-2025-24135 · WordPress · Viral Loops Wp Integration

Name of the Vulnerable Software and Affected Versions: Viral Loops WP Integration versions 3.8.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Viral Loops ...

PT-2025-24125 · Backwp · Backwp

Name of the Vulnerable Software and Affected Versions: Backwp versions n/a through 2.0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Path Traversal. This means an attacker could potentially trick a user into performing unintended actions on the web...

PT-2025-24111 · Unknown · Whassan Ki Live Video Conferences

Name of the Vulnerable Software and Affected Versions: whassan KI Live Video Conferences versions 5.5.15 and earlier Description: The issue is related to a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This can be exploited in...