Scada-lts vulnerabilities
Published CVEs affecting Scada-lts products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-19657
Medium · 6.1
CWE-79 Aug 12, 2026
Cross-site Scripting (XSS) in Scada-lts
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
CVE-2026-19656
Critical · 9.9
CWE-862 Aug 12, 2026
Missing Authorization in Scada-lts
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
CVE-2025-13791
Medium · 6.5
CWE-22 Nov 30, 2025
Scada-LTS Project Import ZIPProjectManager.java Common.getHomeDir path traversal
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-13790
High · 8.8
CWE-352 Nov 30, 2025
Scada-LTS cross-site request forgery
A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.