CVE-2021-28803: Qnap q\'center cross-site scripting vulnerability

Qnap · Q\'Center

This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004.

5.4 CVSS 3.1 Medium EPSS 0.47% · top 62.2% CWE-80 · CWE-80CWE-79 · Cross-site scripting

5.4CVSS 3.1 base score, v2 3.5

0.47%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Q\'Center Qnap

References

Link	Tags
https://www.qnap.com/zh-tw/security-advisory/qsa-21-31	Vendor Advisory
https://www.qnap.com/zh-tw/security-advisory/qsa-21-31	Vendor Advisory

Track CVE-2021-28803 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2018-0708Qnap q\'center os command injection vulnerabilityCommand injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run …EPSS 26%17 Jul 2018 8.8CVE-2018-0709Qnap q\'center os command injection vulnerabilityCommand injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitr…EPSS 13%17 Jul 2018 8.8CVE-2018-0710Qnap q\'center os command injection vulnerabilityCommand injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitra…EPSS 14%17 Jul 2018 8.8CVE-2018-0706QNAP Q'center Virtual Appliance private information exposureQNAP Q'center Virtual Appliance version 1.7.1063 and earlier exposes private information, allowing authenticated users to reach sensitive data. The r…EPSS 48%analysed17 Jul 2018 7.2CVE-2018-0707QNAP Q'center Virtual Appliance command injection in change passwordThe change password function in QNAP Q'center Virtual Appliance 1.7.1063 and earlier does not properly neutralize input, allowing OS command injectio…EPSS 59%analysed17 Jul 2018 5.4CVE-2021-28807Qnap q\'center cross-site scripting vulnerabilityA post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remo…EPSS 1.4%3 Jun 2021 7.5CVE-2026-34486Apache Tomcat EncryptInterceptor bypass exposes sensitive dataApache Tomcat contains a missing encryption of sensitive data flaw: the fix for CVE-2026-29146 can be bypassed, allowing the EncryptInterceptor to be…KEVEPSS 6.6%analysed9 Apr 2026 7.8CVE-2026-21514Microsoft Word security feature bypass via untrusted inputMicrosoft Word relies on untrusted inputs when making a security decision, allowing an attacker to bypass a security feature. The flaw affects Micros…KEVEPSS 1.5%analysed10 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2021-28803), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.