Vulnerabilidades do QNAP Systems Inc. Video Station
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam QNAP Systems Inc. Video Station: 8 registro(s), com versões afetadas e correções.
CVE-2026-44084
Alta · 7.5
CWE-639 15/10/2026
Access Code Forgery in Video Station leading to unauthorized media access
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2026-34015
Média · 6.5
CWE-22 15/10/2026
Remote Code Execution in upload.php of Video Station
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2026-26245
Alta · 8.8
CWE-89 15/10/2026
SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2026-26244
Alta · 8.8
CWE-89 15/10/2026
SQLi#1 SQL Injection in class_videos.php _getFilters
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.8 and later
CVE-2025-66275
Média · 6.5
CWE-22 15/10/2026
Remote code execution via command injection
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later
CVE-2025-66272
Média · 6.5
CWE-22 15/10/2026
Arbitrary file deletion and remote code execution
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version:
Video Station 5.8.5 and later
CVE-2024-14025
Média · 6.7
CWE-89 11/03/2026
Video Station
An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.
We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later
CVE-2024-14024
Média · 6.7
CWE-295 11/03/2026
Video Station
An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to compromise the security of the system.
We have already fixed the vulnerability in the following version:
Video Station 5.8.2 and later