CVE-2026-34185
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. An authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in version 9.8.5.
Risk Assessment
Risk includes unauthorized access, modification, or deletion of SCADA data, potentially disrupting industrial operations.
Recommendation
Immediately upgrade AlanWeb SCADA to version 9.8.5 or later and restrict access to the system.
Other vulnerabilities in AlanWeb SCADA
See all- CVE-2026-34184Critical
AlanWeb SCADA does not enforce authorization for some directories, allowing an unauthorized attacker to read all files in these directories and even execute some of them. The attacker could run PHP scripts directly on the connected database. This issue was fixed in version 9.8.5.
- CVE-2026-4901Medium
AlanWeb SCADA saves sensitive information, including user credentials, into a log file. Combined with another vulnerability (CVE-2026-34184), an unauthorized user could access this data and gain further authorized access to the system.
Original NVD description (English source)
AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in AlanWeb SCADA version 9.8.5