Cross-Site Scripting Vulnerability in QNAP Photo Station Software

CVE-2024-12923

What is CVE-2024-12923?

A cross-site scripting vulnerability has been discovered in QNAP's Photo Station, allowing unauthorized remote attackers to exploit user accounts. This exploitation enables attackers to bypass essential security mechanisms and potentially access sensitive application data. The issue has been addressed in Photo Station version 6.4.5 and later, released on January 2, 2025. Users are strongly encouraged to update their software to mitigate risks.

References