Scadabr

11 CVEs across 1 Scadabr products. Browse Scadabr vulnerabilities, severities, and proof-of-concept exploits.

Scadabr products with known CVEs

ProductCVEs
Scadabr11
Scadabr CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-9646Medium6.12026-05-28A reflected cross-site scripting issue exists in URL handling.
CVE-2026-9645Critical9.92026-05-28Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complet…
CVE-2026-8605Critical9.82026-05-19In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
CVE-2026-8604High8.82026-05-19In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in u…
CVE-2026-8603Critical9.82026-05-19In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.
CVE-2026-8602Critical9.12026-05-19In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to t…
CVE-2025-70973Medium4.82026-03-09ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the sess…
CVE-2021-26829Medium5.42021-06-11OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
CVE-2021-26828High8.82021-06-11OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit…
CVE-2019-16344Medium6.12019-10-14A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or H…
CVE-2019-16321Medium6.12019-09-15ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.