CVE-2025-10466

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct ...

medium 5.9 CVSS 3.1
Published: May 27, 2026
Modified: Jun 2, 2026
Vendor: Synology
Product: Safe Access
Versions: 1.3

Description

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-service in SRM.

References

Related CVEs

CVE-2025-30028 high · 8.6
A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.
CVE-2025-66592 medium · 6.1
An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and cond
CVE-2025-66593 medium · 6.1
An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service
CVE-2026-2237 medium · 6.2
A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to o
CVE-2025-12686 critical · 9.8
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute
CVE-2025-13392 high · 8.1
Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected)