QNAP Systems Inc. Video Station vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting QNAP Systems Inc. Video Station: 8 record(s), with affected versions and fixes.
CVE-2026-44084
High · 7.5
CWE-639 Oct 15, 2026
Access Code Forgery in Video Station leading to unauthorized media access
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2026-34015
Medium · 6.5
CWE-22 Oct 15, 2026
Remote Code Execution in upload.php of Video Station
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2026-26245
High · 8.8
CWE-89 Oct 15, 2026
SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2026-26244
High · 8.8
CWE-89 Oct 15, 2026
SQLi#1 SQL Injection in class_videos.php _getFilters
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2025-66275
Medium · 6.5
CWE-22 Oct 15, 2026
Remote code execution via command injection
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later
CVE-2025-66272
Medium · 6.5
CWE-22 Oct 15, 2026
Arbitrary file deletion and remote code execution
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later
CVE-2024-14025
Medium · 6.7
CWE-89 Mar 11, 2026
Video Station
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later
CVE-2024-14024
Medium · 6.7
CWE-295 Mar 11, 2026
Video Station
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later