High severity7.7NVD Advisory· Published Jun 3, 2021· Updated Jun 17, 2026
CVE-2021-28807
CVE-2021-28807
Description
A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- QNAP Systems Inc./Q’centerv5Range: unspecified
- Range: QTS 4.5.3: v1.12.1012 and later; QTS 4.3.6: v1.10.1004 and later; QTS 4.3.3: v1.10.1004 and later; QuTS hero h4.5.2: v1.12.1012 and later; QuTScloud c4.5.4: v1.12.1012 and later
Patches
Vulnerability mechanics
References
3- www.shielder.it/advisories/qnap-qcenter-post-auth-remote-code-execution-via-qpkg/nvdExploitThird Party Advisory
- www.shielder.it/advisories/qnap-qcenter-virtual-stored-xss/nvdExploitThird Party Advisory
- www.qnap.com/zh-tw/security-advisory/qsa-21-20nvdVendor Advisory
News mentions
0No linked articles in our index yet.