A SQL injection flaw in the class_videos.php _getFilters function of QNAP Video Station allows a remote attacker who has obtained a valid user account to submit specially crafted input that is incorporated into database queries without proper sanitization. This permits the attacker to read sensitive data, modify or delete records, and in some scenarios, execute arbitrary SQL commands that can lead to remote code execution or compromise of the underlying operating system.

The vulnerability affects QNAP's Video Station application across all releases prior to version 5.8.8. Users running earlier builds of Video Station, commonly found on QNAP NAS devices, are exposed while later releases contain a corrective patch introduced in the 5.8.8 update.

The CVSS v3.1 base score of 7.1 reflects a medium severity with potential for code execution; the EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not currently listed in CISA's KEV catalog. However, the attack requires that an attacker has already compromised or guessed a legitimate user account, so the feasibility is heightened if default or weak credentials are in use. When such credentials are present, remote exploitation could lead to full system compromise.