Hydrosystem.poznan vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Hydrosystem.poznan products: 3 record(s), with severity, exploitation and fixes.

Control System 3

Exploited only (KEV) →

CVE-2026-4901 Medium · 6.5 CWE-532 Apr 9, 2026

Insertion of Sesitive Information into Log File in AlanWeb SCADA

AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5

CVE-2026-34185 High · 8.8 CWE-89 Apr 9, 2026

SQL Injection in AlanWeb SCADA

AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in AlanWeb SCADA version 9.8.5

CVE-2026-34184 Critical · 9.1 CWE-862 Apr 9, 2026

Missing Authorization inAlanWeb SCADA

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5