QNAP Photo Station prior 6.0.18 cross site scripting [CVE-2021-34354]