Scadabr vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Scadabr products: 9 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-9646 Medium · 6.1 CWE-80 May 28, 2026

ScadaBR Unauthenticated Reflected Cross-Site Scripting

A reflected cross-site scripting issue exists in URL handling.

CVE-2026-9645 Critical · 9.9 CWE-78 May 28, 2026

ScadaBR Authenticated Remote Code Execution

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

CVE-2026-8605 Critical · 9.8 CWE-798 May 19, 2026

Use of Hard-coded Credentials in ScadaBR

In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.

CVE-2026-8604 High · 8.8 CWE-352 May 19, 2026

Cross-Site request forgery (CSRF) in ScadaBR

In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.

CVE-2026-8603 Critical · 9.8 CWE-78 May 19, 2026

Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR

In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.

CVE-2026-8602 Critical · 9.1 CWE-306 May 19, 2026

Missing authentication for critical function in ScadaBR

In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.

CVE-2025-70973 Medium · 4.8 CWE-384 Mar 9, 2026

Session Fixation in Scadabr

ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. As a result, a session created prior to login becomes authenticated once the victim logs in, allowing an attacker who knows the session ID to hijack an authenticated session.

CVE-2021-26829 Medium · 5.4 KEV High · 53 CWE-79 Jun 11, 2021

OpenPLC ScadaBR Cross-site Scripting Vulnerability

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

CVE-2021-26828 High · 8.8 KEV High · 62 Public exploit CWE-434 Jun 11, 2021

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.