CVE-2020-36198

A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP Systems Inc. Malware Remover 3.x.

• CWE-77
• CWE-78
• CWE-78

• http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.htmlPatch, Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/qsa-21-16Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-592/Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/162849/QNAP-MusicStation-MalwareRemover-File-Upload-Command-Injection.htmlPatch, Third Party Advisory, VDB Entry
• https://www.qnap.com/zh-tw/security-advisory/qsa-21-16Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-592/Third Party Advisory, VDB Entry

Published

May 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-36192An issue was discovered in the Source Integration plugin bef…5.3
• CVE-2020-36193Tar.php in Archive_Tar through 1.4.11 allows write operation…7.5
• CVE-2020-36194An XSS vulnerability has been reported to affect QNAP NAS ru…6.1
• CVE-2020-36195An SQL injection vulnerability has been reported to affect Q…9.8
• CVE-2020-36196A stored XSS vulnerability has been reported to affect QNAP …6.1
• CVE-2020-36197An improper access control vulnerability has been reported t…8.8
• CVE-2020-36199TinyCheck before commits 9fd360d and ea53de8 was vulnerable …9.8
• CVE-2020-3620u'Lack of check of integer overflow while doing a round up o…5.5
• CVE-2020-36200TinyCheck before commits 9fd360d and ea53de8 allowed an auth…6.5
• CVE-2020-36201An issue was discovered in certain Xerox WorkCentre products…7.5
• CVE-2020-36202An issue was discovered in the async-h1 crate before 2.3.0 f…6.1
• CVE-2020-36203An issue was discovered in the reffers crate through 2020-12…4.7