Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
498 results · page 2 of 10
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25895 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25894 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25893 · Other software · frangoteam · reported by GitHubCritical 10
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25752 · Other software · frangoteam · reported by GitHubCritical 9.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25751 · Other software · frangoteam · reported by GitHubCritical 9.1
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input fielCVE-2020-37143 · Other software · GE Intelligent Platforms, Inc. · reported by VulnCheckMedium 4.6
ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input field. Attackers can overwrite the password field with 257 bytes of repeated characters to trigger an application crash and prevent successful authentication.
- Product
- ProficySCADA for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.cnet.comexploit-db.com
Dec 23, 2025FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences.CVE-2024-9684 · Other software · FreyrSCADA · reported by Red HatHigh 7.5
FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences.
- Product
- IEC-60870-5-104
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Dec 18, 2025Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files.CVE-2025-67653 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.3
Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files.
- Product
- WebAccess/SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Dec 18, 2025Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands.CVE-2025-46268 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.3
Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands.
- Product
- WebAccess/SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Dec 18, 2025Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.CVE-2025-14850 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.2
Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.
- Product
- WebAccess/SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Dec 18, 2025Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.CVE-2025-14849 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.
- Product
- WebAccess/SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Dec 18, 2025Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.CVE-2025-14848 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.3
Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.
- Product
- WebAccess/SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Nov 30, 2025A vulnerability was identified in Scada-LTS up to 2.7.8.1.CVE-2025-13791 · Other software · Scada-lts · reported by VulDBLow 2.1
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2025A vulnerability was determined in Scada-LTS up to 2.7.8.1.CVE-2025-13790 · Other software · Scada-lts · reported by VulDBLow 2.1
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025A flaw has been found in Scada-LTS up to 2.7.8.1.CVE-2025-10235 · Other software · Scada-lts · reported by VulDBLow 1.9
A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This manipulation of the argument Colour causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025A vulnerability was detected in Scada-LTS up to 2.7.8.1.CVE-2025-10234 · Other software · Scada-lts · reported by VulDBLow 1.9
A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point Edit Module. The manipulation of the argument Text Renderer properties results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2025A vulnerability was identified in Scada-LTS up to 2.7.8.1.CVE-2025-9404 · Other software · Scada-lts · reported by VulDBLow 1.9
A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder Handler. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2025A vulnerability was determined in Scada-LTS up to 2.7.8.1.CVE-2025-9388 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A flaw has been found in Scada-LTS up to 2.7.8.1.CVE-2025-9235 · Other software · Scada-lts · reported by VulDBLow 2
A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability was detected in Scada-LTS up to 2.7.8.1.CVE-2025-9234 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. The manipulation of the argument Alias results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A security vulnerability has been detected in Scada-LTS up to 2.7.8.1.CVE-2025-9233 · Other software · Scada-lts · reported by VulDBLow 2
A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manipulation of the argument Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A security vulnerability has been detected in Scada-LTS 2.7.8.1.CVE-2025-9145 · Other software · Scada-lts · reported by VulDBLow 2
A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file view_edit.shtm of the component SVG File Handler. Such manipulation of the argument backgroundImageMP leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A weakness has been identified in Scada-LTS 2.7.8.1.CVE-2025-9144 · Other software · Scada-lts · reported by VulDBLow 2
A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisher_edit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A security flaw has been discovered in Scada-LTS 2.7.8.1.CVE-2025-9143 · Other software · Scada-lts · reported by VulDBLow 2
A security flaw has been discovered in Scada-LTS 2.7.8.1. This affects an unknown part of the file mailing_lists.shtm. The manipulation of the argument name/userList/address results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A vulnerability was determined in Scada-LTS 2.7.8.1.CVE-2025-9139 · Other software · Scada-lts · reported by VulDBLow 2.1
A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower."
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability was found in Scada-LTS 2.7.8.1.CVE-2025-9138 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability was found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users."
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A vulnerability has been found in Scada-LTS 2.7.8.1.CVE-2025-9137 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability has been found in Scada-LTS 2.7.8.1. This impacts an unknown function of the file scheduled_events.shtm. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users."
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 8, 2025A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1.CVE-2025-8743 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. This affects an unknown part of the file /data_source_edit.shtm of the component Virtual Data Source Property Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL InjCVE-2025-4822 · Other software · Bayraktar Solar Energies · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL Injection. This issue affects ScadaWatt Otopilot: before 27.05.2025.
- Product
- ScadaWatt Otopilot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Jul 16, 2025A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1.CVE-2025-7729 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file usersProfiles.shtm. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1.CVE-2025-7728 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of the file users.shtm. The manipulation of the argument Username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product.CVE-2025-39205 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.1
A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack due to missing proper validation.
- Product
- MicroSCADA X SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Jun 24, 2025A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product.CVE-2025-39204 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.5
A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data can leak unauthorized information to the user.
- Product
- MicroSCADA X SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Jun 24, 2025A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product.CVE-2025-39203 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.1
A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial of service resulting in disconnection loop.
- Product
- MicroSCADA X SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Jun 24, 2025A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product.CVE-2025-39202 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.3
A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite files causing information leak and data corruption.
- Product
- MicroSCADA X SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Jun 24, 2025A vulnerability exists in MicroSCADA X SYS600 product.CVE-2025-39201 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 6.9
A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of Notify service.
- Product
- MicroSCADA X SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Jun 14, 2025DIOT SCADA with MQTT: Stored Cross-Site ScriptingCVE-2025-4216 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DIOT SCADA with MQTT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'diot' shortcode in all versions up to, and including, 1.0.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- DIOT SCADA with MQTT
- Affected
- up to 1.0.5.1
- What to do
- Affects up to 1.0.5.1. Update DIOT SCADA with MQTT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 11, 2025A password is exposed locally.CVE-2025-35941 · Other software · mySCADA · reported by vulnreport@tenable.comMedium 5.5
A password is exposed locally.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.CVE-2025-25067 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensiCVE-2025-24865 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 10
The administrative web interface of mySCADA myPRO Manager can be accessed without authentication which could allow an unauthorized attacker to retrieve sensitive information and upload files without the associated password.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025mySCADA myPRO Manager is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to obtain sensitive information.CVE-2025-23411 · Other software · mySCADA · reported by ics-cert@hq.dhs.govMedium 5.1
mySCADA myPRO Manager is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to obtain sensitive information. An attacker would need to trick the victim in to visiting an attacker-controlled website.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.CVE-2025-22896 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.2
mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information.CVE-2025-20061 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
mySCADA myPRO does not properly neutralize POST requests sent to a specific port with email information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information.CVE-2025-20014 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
mySCADA myPRO does not properly neutralize POST requests sent to a specific port with version information. This vulnerability could be exploited by an attacker to execute arbitrary commands on the affected system.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on worCVE-2024-12703 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.5
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when a non-admin authenticated user opens a malicious project file.
- Product
- RemoteConnect and SCADAPack x70 Utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Nov 22, 2024An OS Command Injection vulnerability exists within myPRO Manager.CVE-2024-52034 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 10
An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and CVE-2024-50054 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 8.7
The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbiCVE-2024-47407 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 10
A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.CVE-2024-47138 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.CVE-2024-45369 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.2
The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.
- Product
- myPRO Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.