CVE-2026-115803
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was found in Scada-LTS 2.8.0 in the HttpServletRequest.getParameter function of AmChartValuesAPI.java within the AmCharts Data API component. Manipulating the ids argument can lead to authorization bypass, and the attack can be executed remotely. The exploit has been published and may be used.
Risk Assessment
A remote attacker could bypass authorization controls and gain unauthorized access to API data. Since the exploit is publicly available, the likelihood of exploitation is high.
Recommendation
Restrict network access to the AmCharts API and monitor for manipulation of the ids parameter. Apply the fix once the vendor releases the security-enhanced version.
Other vulnerabilities in Scada-LTS
See all- CVE-2025-13791Medium
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2025-13790Medium
A vulnerability was determined in Scada-LTS up to 2.7.8.1. An unknown function is vulnerable to Cross-Site Request Forgery (CSRF). The attack may be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2025-10235Low
A cross-site scripting (XSS) vulnerability was found in Scada-LTS up to version 2.7.8.1 in the /reports.shtm file of the Reports Module component. Manipulating the Colour argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
- CVE-2025-10234Low
A cross-site scripting (XSS) vulnerability was detected in Scada-LTS up to version 2.7.8.1 in the /data_point_edit.shtm file of the Data Point Edit Module component. Manipulating the Text Renderer properties leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Original NVD description (English source)
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS