CVE-2018-0711

Cross-site scripting (XSS) vulnerability in QNAP QTS 4.3.3 build 20180126, QTS 4.3.4 build 20180315, and their earlier versions could allow remote attackers to inject arbitrary web script or HTML.

• CWE-79

• http://www.securitytracker.com/id/1040779Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/nas-201804-27Vendor Advisory
• http://www.securitytracker.com/id/1040779Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/nas-201804-27Vendor Advisory

Published

Apr 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0705Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8…
• CVE-2018-0706Exposure of Private Information in QNAP Q'center Virtual App…
• CVE-2018-0707Command injection vulnerability in change password of QNAP Q…
• CVE-2018-0708Command injection vulnerability in networking of QNAP Q'cent…
• CVE-2018-0709Command injection vulnerability in date of QNAP Q'center Vir…
• CVE-2018-0710Command injection vulnerability in SSH of QNAP Q'center Virt…
• CVE-2018-0712Command injection vulnerability in LDAP Server in QNAP QTS 4…
• CVE-2018-0714Command injection vulnerability in Helpdesk versions 1.1.21 …
• CVE-2018-0715Cross-site scripting vulnerability in QNAP Photo Station ver…
• CVE-2018-0716Cross-site scripting vulnerability in QTS 4.2.6 build 201807…
• CVE-2018-0718Command injection vulnerability in Music Station 5.1.2 and e…
• CVE-2018-0719Cross-site Scripting (XSS) vulnerability in NAS devices of Q…5.5