CVE-2024-12923

Photo Station

State: Published
Severity: 2.0 Low
Published: Aug 29, 2025
Updated: Aug 29, 2025
Reserved: Dec 25, 2024

Description

A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following version: Photo Station 6.4.5 ( 2025/01/02 ) and later

Scores

CVSS	Score	Vector	Source
4.0	2.0 Low	CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L	qnap

Weaknesses

CWE-79

Affected Products

Product	Versions
Photo StationQNAP Systems Inc.	6.4.x to before 6.4.5 ( 2025/01/02 )Affected

References

https://www.qnap.com/en/security-advisory/qsa-25-24

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.