CVE-2026-19657
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
Risk Assessment
The risk includes execution of malicious scripts in the victim's session context, potentially leading to data theft, session hijacking, or other attacks.
Recommendation
Upgrade ScadaLTS to a patched version and implement input validation and output encoding.
Original NVD description (English source)
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.