Scadabr

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorScadabr (9f989e61-8e77-57a4-bed4-85169bb58fc5)
ProductScadabr (bf2aacb1-a495-57f1-a3a8-89592bad8c15)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/scadabr/scadabr purl2cpe 2026-06-01 10:13:44.977942
pkg:sourceforge/scadabr purl2cpe 2026-06-01 10:13:44.977944

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-94148 vulnerable 2026-10-13 12:28:38.783822 ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure
MEDIUM (5.3)
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.
Published: 2026-09-21T07:15:08.516Z
Updated: 2026-09-21T19:27:19.388Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-9646 vulnerable 2026-06-08 08:08:59.068936 ScadaBR Unauthenticated Reflected Cross-Site Scripting
MEDIUM (6.1)
A reflected cross-site scripting issue exists in URL handling.
Published: 2026-05-28T20:32:27.819Z
Updated: 2026-05-29T14:44:42.850Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-9645 vulnerable 2026-06-08 08:08:59.068805 ScadaBR Authenticated Remote Code Execution
CRITICAL (9.9)
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.
Published: 2026-05-28T20:30:13.813Z
Updated: 2026-05-29T14:51:41.509Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-8605 vulnerable 2026-06-08 08:08:58.479491 Use of Hard-coded Credentials in ScadaBR
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
Published: 2026-05-19T17:08:06.580Z
Updated: 2026-05-19T17:58:03.116Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-8604 vulnerable 2026-06-08 08:08:58.479157 Cross-Site request forgery (CSRF) in ScadaBR
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
Published: 2026-05-19T17:05:48.113Z
Updated: 2026-05-19T18:00:59.900Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-8603 vulnerable 2026-06-08 08:08:58.478892 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-8602 vulnerable 2026-06-08 08:08:58.478445 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-26829 vulnerable 2026-06-08 05:30:45.264365 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-26828 vulnerable 2026-06-08 05:30:45.263576 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.