CVE-2025-54167CWE-79cross-site-scripting

CVE-2025-54167

published November 7, 2025

CVSS
7.2
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability has been reported to affect Notification Center. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions:

Notification Center 2.1.0.3443 and later

Notification Center 1.9.2.3163 and later

Notification Center 3.0.0.3466 and later

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
Not supplied
EPSS
0.00534 · 44.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-07T21:15Z
References (1)
https://www.qnap.com/en/security-advisory/qsa-25-40 · [email protected]
EPSS history
Timeline
  • 07 NOV 15:12Z
    Notification Center
    cvelistv5