A stored cross‑site scripting vulnerability exists in QNAP Notes Station 3. An attacker who has access to a user account can upload a note or file that contains malicious JavaScript or other executable code. When other users view or download the content, the injected code runs in their browsers, enabling the attacker to steal session cookies, manipulate page content, or perform actions in the context of the victim’s account. The flaw is a classic stored XSS weakness (CWE‑79).

All releases of QNAP Notes Station 3 prior to version 3.9.12 are affected. The vendor has released a fix in Notes Station 3 3.9.12 and later, which removes the vulnerability by properly sanitizing uploaded content.

The CVSS score of 4.8 indicates moderate severity. Because the attacker must first obtain legitimate user credentials, the attack requires remote access to a valid account, which is the likely vector. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalogue, so the probability of widespread exploitation is low. Nonetheless, any unpatched deployment poses a risk of credential‑based data theft or manipulation, and should be updated promptly.