CVE-2025-10234
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was detected in Scada-LTS up to version 2.7.8.1 in the /data_point_edit.shtm file of the Data Point Edit Module component. Manipulating the Text Renderer properties leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Risk Assessment
A remote attacker could execute a malicious script in the user's browser, potentially leading to session or data theft. In SCADA systems, this could have serious consequences for operational security.
Recommendation
Implement validation and sanitization of the Text Renderer properties and consider using a WAF. Monitor for available updates and consider alternative solutions if no fix is released.
Other vulnerabilities in Scada-LTS
See all- CVE-2025-13791Medium
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Affected is the function Common.getHomeDir of the file br/org/scadabr/vo/exporter/ZIPProjectManager.java of the component Project Import. Such manipulation leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2025-13790Medium
A vulnerability was determined in Scada-LTS up to 2.7.8.1. An unknown function is vulnerable to Cross-Site Request Forgery (CSRF). The attack may be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2025-10235Low
A cross-site scripting (XSS) vulnerability was found in Scada-LTS up to version 2.7.8.1 in the /reports.shtm file of the Reports Module component. Manipulating the Colour argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.
Original NVD description (English source)
A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point Edit Module. The manipulation of the argument Text Renderer properties results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS