CVE-2026-22895CWE-79

QuFTP Service

Medium · published March 20, 2026

CVSS v4.0
6.2
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an administrator account, they can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following versions:

QuFTP Service 1.4.3 and later

QuFTP Service 1.5.2 and later

QuFTP Service 1.6.2 and later

The record
Technical detail
CVSS v4.0
6.2 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-20T16:21Z
EPSS history
Timeline
  • 20 MAR 16:21Z
    QuFTP Service
    cvelistv5