Veille CVE

Recherche « Scadabr scadabr »

9 CVE

Critique 4 Élevée 2 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Scadabr scadabr » ✕
  1. CVE-2026-94148 5.3 Moyenne

    ScadaBR

    A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.

  2. CVE-2026-9646 6.1 Moyenne

    ScadaBR · Scadabr scadabr

    A reflected cross-site scripting issue exists in URL handling.

  3. CVE-2026-9645 9.9 Critique

    ScadaBR · Scadabr scadabr

    Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

  4. CVE-2026-8605 9.8 Critique

    ScadaBR · Scadabr scadabr

    In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.

  5. CVE-2026-8604 8.8 Élevée

    ScadaBR · Scadabr scadabr

    In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.

  6. CVE-2026-8603 9.8 Critique

    ScadaBR · Scadabr scadabr

    In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.

  7. CVE-2026-8602 9.1 Critique

    ScadaBR · Scadabr scadabr

    In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.

  8. CVE-2021-26829 5.4 Moyenne Exploitée

    Scadabr scadabr

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

  9. CVE-2021-26828 8.8 Élevée Exploitée

    Scadabr scadabr

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.