CVE-2026-9646

Published May 28, 2026

Last updated 20 days ago

CVSS medium 6.1

Overview

Description: A reflected cross-site scripting issue exists in URL handling.
Source: vulnreport@tenable.com
NVD status: Analyzed
Products: scadabr

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

vulnreport@tenable.com: CWE-80

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:scadabr:scadabr:1.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "5D144655-8463-45BF-ACD3-FB5F7D49D2B2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.•CVE-2026-9645
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.•CVE-2026-8604
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.•CVE-2026-8605
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.•CVE-2026-8602
In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.•CVE-2026-8603

References

Sources include official advisories and independent security research.

https://nvd.nist.gov/vuln/detail/CVE-2026-9646
https://www.tenable.com/security/research/tra-2026-46

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References