Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Oct 24, 2026A flaw has been found in Scada-LTS 2.8.0.CVE-2026-115803 · Other software · reported by VulDBLow 2.1
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispaCVE-2026-84860 · Other software · Scada-LTS · reported by vulnreport@tenable.comHigh 8.8
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body. This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.
- Product
- Scada-LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing aCVE-2026-84859 · Other software · Scada-LTS · reported by vulnreport@tenable.comMedium 6.5
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users. The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml.
- Product
- Scada-LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" classCVE-2026-84858 · Other software · Scada-LTS · reported by vulnreport@tenable.comHigh 8.8
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.
- Product
- Scada-LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization.CVE-2026-19657 · Other software · SCADA-LTS · reported by vulnreport@tenable.comMedium 6.1
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
- Product
- ScadaLTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-oCVE-2026-19656 · Other software · SCADA-LTS · reported by vulnreport@tenable.comCritical 9.9
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
- Product
- ScadaLTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2025A vulnerability was identified in Scada-LTS up to 2.7.8.1.CVE-2025-13791 · Other software · Scada-lts · reported by VulDBLow 2.1
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2025A vulnerability was determined in Scada-LTS up to 2.7.8.1.CVE-2025-13790 · Other software · Scada-lts · reported by VulDBLow 2.1
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025A flaw has been found in Scada-LTS up to 2.7.8.1.CVE-2025-10235 · Other software · Scada-lts · reported by VulDBLow 1.9
A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This manipulation of the argument Colour causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2025A vulnerability was detected in Scada-LTS up to 2.7.8.1.CVE-2025-10234 · Other software · Scada-lts · reported by VulDBLow 1.9
A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point Edit Module. The manipulation of the argument Text Renderer properties results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2025A vulnerability was identified in Scada-LTS up to 2.7.8.1.CVE-2025-9404 · Other software · Scada-lts · reported by VulDBLow 1.9
A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder Handler. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2025A vulnerability was determined in Scada-LTS up to 2.7.8.1.CVE-2025-9388 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A flaw has been found in Scada-LTS up to 2.7.8.1.CVE-2025-9235 · Other software · Scada-lts · reported by VulDBLow 2
A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability was detected in Scada-LTS up to 2.7.8.1.CVE-2025-9234 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. The manipulation of the argument Alias results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A security vulnerability has been detected in Scada-LTS up to 2.7.8.1.CVE-2025-9233 · Other software · Scada-lts · reported by VulDBLow 2
A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manipulation of the argument Name leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A security vulnerability has been detected in Scada-LTS 2.7.8.1.CVE-2025-9145 · Other software · Scada-lts · reported by VulDBLow 2
A security vulnerability has been detected in Scada-LTS 2.7.8.1. This issue affects some unknown processing of the file view_edit.shtm of the component SVG File Handler. Such manipulation of the argument backgroundImageMP leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A weakness has been identified in Scada-LTS 2.7.8.1.CVE-2025-9144 · Other software · Scada-lts · reported by VulDBLow 2
A weakness has been identified in Scada-LTS 2.7.8.1. This vulnerability affects unknown code of the file publisher_edit.shtm. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A security flaw has been discovered in Scada-LTS 2.7.8.1.CVE-2025-9143 · Other software · Scada-lts · reported by VulDBLow 2
A security flaw has been discovered in Scada-LTS 2.7.8.1. This affects an unknown part of the file mailing_lists.shtm. The manipulation of the argument name/userList/address results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A vulnerability was determined in Scada-LTS 2.7.8.1.CVE-2025-9139 · Other software · Scada-lts · reported by VulDBLow 2.1
A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower."
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025A vulnerability was found in Scada-LTS 2.7.8.1.CVE-2025-9138 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability was found in Scada-LTS 2.7.8.1. Affected is an unknown function of the file pointHierarchy/new/. Performing manipulation of the argument Title results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users."
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 19, 2025A vulnerability has been found in Scada-LTS 2.7.8.1.CVE-2025-9137 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability has been found in Scada-LTS 2.7.8.1. This impacts an unknown function of the file scheduled_events.shtm. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower. An admin user - by definition - has full control over HTML and JS code that is delivered to users in regular synoptic panels. In other words - due to the design of the system it is not possible to limit the admin user to attack the users."
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Aug 8, 2025A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1.CVE-2025-8743 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. This affects an unknown part of the file /data_source_edit.shtm of the component Virtual Data Source Property Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1.CVE-2025-7729 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic was found in Scada-LTS up to 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file usersProfiles.shtm. The manipulation of the argument Username leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1.CVE-2025-7728 · Other software · Scada-lts · reported by VulDBLow 2
A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. Affected is an unknown function of the file users.shtm. The manipulation of the argument Username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this issue and confirmed that it will be fixed in the upcoming release 2.8.0.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2024A vulnerability has been found in Scada-LTS 2.7.8 and classified as problematic.CVE-2024-7901 · Other software · Scada-lts · reported by VulDBMedium 5.3
A vulnerability has been found in Scada-LTS 2.7.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/app.shtm#/alarms/Scada of the component Message Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: A fix is planned for the upcoming release at the end of September 2024.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, executeCVE-2023-33472 · Other software · scada-lts · reported by MITREHigh 8.8
An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, execute arbitrary code, and obtain sensitive information via Event Handlers function.
- Product
- scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhev0x.github.iohev0x.github.io
Apr 10, 2023An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privilegedCVE-2022-41976 · Other software · Scada-lts · reported by MITRECritical 9.9
An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privileged user to change role (e.g., to administrator) by updating their user profile.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscada-lts.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.