7.1High
CVE-2026-26244SQLi#1 SQL Injection in class_videos.php _getFilters
Description
A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Weakness (CWE):
CWE-89
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| QNAP Systems Inc. | Video Station | 5.8.x – < 5.8.8 |
References and patches
- https://www.qnap.com/en/app-release-notes?keyword=Video%20Station&app=VideoStationPro&product-line=nas release-notesRelease Notes
CPE matches (NVD) (1)
cpe:2.3:a:qnap:video_station:*:*:*:*:*:*:*:*≥ 5.8.0 < 5.8.8