Scadabr: >> Scadabr >> 1.2 Security Vulnerabilities
A reflected cross-site scripting issue exists in URL handling.
CVSS Score
6.1
EPSS Score
0.002
Published
2026-05-28
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.
CVSS Score
9.9
EPSS Score
0.003
Published
2026-05-28
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
CVSS Score
8.6
EPSS Score
0.002
Published
2026-05-19
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
CVSS Score
5.1
EPSS Score
0.004
Published
2026-05-19
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
CVSS Score
8.8
EPSS Score
0.004
Published
2026-05-19
In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.
CVSS Score
8.7
EPSS Score
0.013
Published
2026-05-19