CVE-2020-2494

This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code. QANP have already fixed this vulnerability in the following versions of Music Station. QuTS hero h4.5.1: Music Station 5.3.13 and later QTS 4.5.1: Music Station 5.3.12 and later QTS 4.4.3: Music Station 5.3.12 and later

• CWE-79
• CWE-80
• CWE-79

• https://www.qnap.com/en/security-advisory/qsa-20-13Vendor Advisory
• https://www.qnap.com/en/security-advisory/qsa-20-13Vendor Advisory

Published

Dec 10, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24925A Sensitive Source Code Path Disclosure vulnerability is fou…7.5
• CVE-2020-24928managers/socketManager.ts in PreMiD through 2.1.3 has a loca…5.3
• CVE-2020-2493This cross-site scripting vulnerability in Multimedia Consol…6.1
• CVE-2020-24930Beijing Wuzhi Internet Technology Co., Ltd. Wuzhi CMS 4.0.1 …8.1
• CVE-2020-24932An SQL Injection vulnerability exists in Sourcecodester Comp…9.8
• CVE-2020-24939Prototype pollution in Stampit supermixer 1.0.3 allows an at…7.5
• CVE-2020-24940An issue was discovered in Laravel before 6.18.34 and 7.x be…7.5
• CVE-2020-24941An issue was discovered in Laravel before 6.18.35 and 7.x be…7.5
• CVE-2020-24944picoquic (before 3rd of July 2020) allows attackers to cause…7.5
• CVE-2020-24948The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin…7.2
• CVE-2020-24949Privilege escalation in PHP-Fusion 9.03.50 downloads/downloa…8.8
• CVE-2020-2495If exploited, this cross-site scripting vulnerability could …6.1