Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2021-34355

Stored XSS Vulnerability in Photo Station

High7.6EPSS 0.65%
Published
Updated
Reserved
Assigned by
qnap

Description

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later

Timeline

  1. ID reserved

    By qnap

  2. · 4 months later

    Published

  3. · 3 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2021-34355, by who scored it
Scored byCVSSScoreVector
qnapCNA (assigner)3.1High7.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
NVDNVD · Modified3.1Medium5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.65% · top 49% of all CVEs (7 Nov 2026)
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.

Weakness

Affected products

  • QNAP Systems Inc. · Photo Station

    • affected unspecified – < 5.4.10 ( 2021/08/19 )
    • affected unspecified – < 5.7.13 ( 2021/08/19 )
    • affected unspecified – < 6.0.18 ( 2021/09/01 )

What to do

Solution: We have already fixed this vulnerability in the following versions of Photo Station: Photo Station 5.4.10 ( 2021/08/19 ) and later Photo Station 5.7.13 ( 2021/08/19 ) and later Photo Station 6.0.18 ( 2021/09/01 ) and later

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2021-34355 badge
[![CVE-2021-34355](https://trackcve.app/badge/CVE-2021-34355.svg)](https://trackcve.app/cve/CVE-2021-34355)

Record last updated .