CVE-2015-6909

Cross-site scripting (XSS) vulnerability in the "Create download task via file upload" feature in Synology Download Station before 3.5-2962 allows remote attackers to inject arbitrary web script or HTML via the name element in the Info dictionary in a torrent file.

• CWE-79

• http://packetstormsecurity.com/files/133520/Synology-Download-Station-3.5-2956-3.5-2962-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2015/Sep/32
• http://www.securityfocus.com/archive/1/536428/100/0/threaded
• https://www.securify.nl/advisory/SFY20150809/multiple_cross_site_scripting_vulnerabilities_in_synology_download_station.htmlExploit
• https://www.synology.com/en-global/releaseNote/DownloadStation?model=DS715Vendor Advisory
• https://www.synology.com/en-global/support/security/Download_Station_3_5_2962Vendor Advisory
• http://packetstormsecurity.com/files/133520/Synology-Download-Station-3.5-2956-3.5-2962-Cross-Site-Scripting.html
• http://seclists.org/fulldisclosure/2015/Sep/32
• http://www.securityfocus.com/archive/1/536428/100/0/threaded
• https://www.securify.nl/advisory/SFY20150809/multiple_cross_site_scripting_vulnerabilities_in_synology_download_station.htmlExploit
• https://www.synology.com/en-global/releaseNote/DownloadStation?model=DS715Vendor Advisory
• https://www.synology.com/en-global/support/security/Download_Station_3_5_2962Vendor Advisory

Published

Sep 11, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-6903Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-6904Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-6905Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-6906Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-6907Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-6908The ber_get_next function in libraries/liblber/io.c in OpenL…
• CVE-2015-6910SQL injection vulnerability in Synology Video Station before…
• CVE-2015-6911SQL injection vulnerability in Synology Video Station before…
• CVE-2015-6912Synology Video Station before 1.5-0763 allows remote attacke…
• CVE-2015-6913Cross-site scripting (XSS) vulnerability in the "Create down…
• CVE-2015-6914Absolute path traversal vulnerability in SiteFactory CMS 5.5…
• CVE-2015-6915SQL injection vulnerability in Montala Limited ResourceSpace…