Scadabr
Vulnerability activity for Scadabr: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 4
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.1MediumMay 28, 2026scadabr XSSCVE-2026-9646A reflected cross-site scripting issue exists in URL handling.
- 9.9CriticalMay 28, 2026scadabr Code / command injectionCVE-2026-9645Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.
- 9.8CriticalMay 19, 2026scadabr Auth bypass / access controlCVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
- 8.8HighMay 19, 2026scadabr CSRFCVE-2026-8604In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
- 9.8CriticalMay 19, 2026scadabr Code / command injectionCVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.
- 9.1CriticalMay 19, 2026scadabr Auth bypass / access controlCVE-2026-8602In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
- 4.8MediumMar 9, 2026scadabrCVE-2025-70973ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. As a result, a session created prior to login becomes authenticated once the victim logs in, allowing an attacker who knows the session ID to hijack an authenticated session.
Top products
- scadabr7 CVEs in the last year, 4 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.