Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
61 results · page 1 of 2
Nov 11, 2025Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.CVE-2017-20210 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-12923 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twLow 2
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: Photo Station 6.4.5 ( 2025/01/02 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32770 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32769 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32768 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2024-32767 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow remote attackers who have gained user access to inject malicious code. We have already fixed the vulnerability in the following version: Photo Station 6.4.3 ( 2024/07/12 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2024A path traversal vulnerability has been reported to affect Photo Station.CVE-2023-47221 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administrators to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 ( 2023/12/15 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024An OS command injection vulnerability has been reported to affect Photo Station.CVE-2023-47562 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.4
An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 ( 2023/12/15 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2024A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.CVE-2023-47561 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.5
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: Photo Station 6.4.2 ( 2023/12/15 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022QNAP Photo Station Externally Controlled Reference VulnerabilityCVE-2022-27593 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 10
Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.
- Product
- Photo Station
- On CISA’s list since
- Sep 8, 2022 (federal fix deadline Sep 29, 2022)
- What to do
- Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogqnap.comqnap.com
Jul 6, 2022Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint vCVE-2022-22681 · Network & remote access · Synology · reported by security@synology.comHigh 8.1
Session fixation vulnerability in access control management in Synology Photo Station before 6.8.16-3506 allows remote attackers to bypass security constraint via unspecified vectors.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
May 5, 2022An improper authentication vulnerability has been reported to affect QNAP device running Photo Station.CVE-2021-44057 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.1
An improper authentication vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.20 ( 2022/02/15 ) and later Photo Station 5.7.16 ( 2022/02/11 ) and later Photo Station 5.4.13 ( 2022/02/11 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2021A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station.CVE-2021-34356 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.6
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2021A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station.CVE-2021-34355 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.6
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2021A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station.CVE-2021-34354 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.6
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 6.0.18 ( 2021/09/01 ) and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2021Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.1CVE-2021-29089 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jun 1, 2021Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.1CVE-2021-29091 · Network & remote access · Synology · reported by security@synology.comHigh 7.7
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to write arbitrary files via unspecified vectors.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jun 1, 2021Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500CVE-2021-29090 · Network & remote access · Synology · reported by security@synology.comHigh 7.2
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jun 1, 2021Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticaCVE-2021-29092 · Network & remote access · Synology · reported by security@synology.comHigh 8.8
Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 16, 2021This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code.CVE-2020-2502 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2020This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code.CVE-2020-2491 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. QTS 4.5.1: Photo Station 6.0.12 and later QTS 4.4.3: Photo Station 6.0.12 and later QTS 4.3.6: Photo Station 5.7.12 and later QTS 4.3.4: Photo Station 5.7.13 and later QTS 4.3.3: Photo Station 5.4.10 and later QTS 4.2.6: Photo Station 5.2.11 and later
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station.CVE-2018-19956 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station.CVE-2018-19955 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station.CVE-2018-19954 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.1
The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2019QNAP Photo Station Path Traversal VulnerabilityCVE-2019-7195 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
- Product
- Photo Station
- On CISA’s list since
- Jun 8, 2022 (federal fix deadline Jun 22, 2022)
- What to do
- Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comqnap.com
Dec 5, 2019QNAP Photo Station Path Traversal VulnerabilityCVE-2019-7194 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
- Product
- Photo Station
- On CISA’s list since
- Jun 8, 2022 (federal fix deadline Jun 22, 2022)
- What to do
- Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comqnap.com
Dec 5, 2019QNAP Photo Station Improper Access Control VulnerabilityCVE-2019-7192 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
- Product
- Photo Station
- On CISA’s list since
- Jun 8, 2022 (federal fix deadline Jun 22, 2022)
- What to do
- Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comqnap.com
Jun 30, 2019Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to uploCVE-2019-11822 · Network & remote access · Synology · reported by security@synology.comMedium 4.3
Relative path traversal vulnerability in SYNO.PhotoStation.File in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to upload arbitrary files via the uploadphoto parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jun 30, 2019SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitCVE-2019-11821 · Network & remote access · Synology · reported by security@synology.comHigh 7.3
SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 1, 2019Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allCVE-2018-0722 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twHigh 7.5
Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3, 5.2.8 and earlier in QTS 4.2.6 could allow remote attackers to access sensitive information on the device.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2018Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSCVE-2018-13282 · Network & remote access · Synology · reported by security@synology.comMedium 5.6
Session fixation vulnerability in SYNO.PhotoStation.Auth in Synology Photo Station before 6.8.7-3481 allows remote attackers to hijack web sessions via the PHPSESSID parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Aug 27, 2018Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised apCVE-2018-0715 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twMedium 6.1
Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comqnap.com
Jun 8, 2018Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated usCVE-2018-8926 · Network & remote access · Synology · reported by security@synology.comHigh 8.8
Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privilege escalation attacks via the fullname parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jun 8, 2018Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijCVE-2018-8925 · Network & remote access · Synology · reported by security@synology.comHigh 8.8
Cross-site request forgery (CSRF) vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the (1) username, (2) password, (3) admin, (4) action, (5) uid, or (6) modify_admin parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Apr 23, 2018Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers toCVE-2017-13073 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twMedium 6.1
Cross-site scripting (XSS) vulnerability in QNAP NAS application Photo Station versions 5.2.7, 5.4.3, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2018Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticaCVE-2017-16772 · Network & remote access · Synology · reported by security@synology.comHigh 8.8
Improper input validation vulnerability in SYNOPHOTO_Flickr_MultiUpload in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote authenticated users to execute arbitrary codes via the prog_id parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Mar 22, 2018Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitraCVE-2017-16771 · Network & remote access · Synology · reported by security@synology.comMedium 6.1
Cross-site scripting (XSS) vulnerability in Log Viewer in Synology Photo Station before 6.8.3-3463 and before 6.3-2971 allows remote attackers to inject arbitrary web script or HTML via the username parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 23, 2018Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protCVE-2017-16769 · Network & remote access · Synology · reported by security@synology.comMedium 5.3
Exposure of private information vulnerability in Photo Viewer in Synology Photo Station 6.8.1-3458 allows remote attackers to obtain metadata from password-protected photographs via the map viewer mode.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Dec 20, 2017Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitCVE-2017-12072 · Network & remote access · Synology · reported by security@synology.comMedium 5.4
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.8.0-3456 allows remote authenticated users to inject arbitrary web scripts or HTML via the id parameter.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Dec 4, 2017An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackersCVE-2017-12080 · Network & remote access · Synology · reported by security@synology.comMedium 5.3
An information exposure vulnerability in default HTTP configuration file in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain sensitive system information via .htaccess file.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Dec 4, 2017Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote atCVE-2017-12079 · Network & remote access · Synology · reported by security@synology.comHigh 7.5
Files or directories accessible to external parties vulnerability in picasa.php in Synology Photo Station before 6.8.1-3458 and before 6.3-2970 allows remote attackers to obtain arbitrary files via prog_id field.
- Product
- Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Sep 8, 2017Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users tCVE-2017-12071 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Server-side request forgery (SSRF) vulnerability in file_upload.php in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to download arbitrary local files via the url parameter.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Sep 8, 2017Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary filCVE-2017-11162 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Directory traversal vulnerability in synphotoio in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allows remote authenticated users to read arbitrary files via unspecified vectors.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Sep 8, 2017Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via theCVE-2017-11161 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Aug 24, 2017Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web sCVE-2017-9555 · Network & remote access · Synology · reported by security@synology.comMedium 5.4
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Aug 23, 2017Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to execute arbCVE-2017-11159 · Network & remote access · Synology · reported by security@synology.comHigh 7.8
Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse (1) shfolder.dll, (2) ntmarta.dll, (3) secur32.dll or (4) dwmapi.dll file in the current working directory.
- Product
- Photo Station Uploader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Aug 8, 2017An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system iCVE-2017-11155 · Network & remote access · Synology · reported by security@synology.comHigh 7.5
An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsynology.com
Aug 8, 2017Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbiCVE-2017-11154 · Network & remote access · Synology · reported by security@synology.comHigh 7.2
Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsynology.com
Aug 8, 2017Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administratoCVE-2017-11153 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsynology.com
Aug 8, 2017Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary CVE-2017-11152 · Network & remote access · Synology · reported by security@synology.comHigh 7.5
Directory traversal vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to write arbitrary files via the path parameter.
- Product
- Synology Photo Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsynology.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.