CVE-2026-16462

EUVD-2026-49733 CRITICAL

SQL Injection (CWE-89)

2026-07-28 info@cert.vde.com

GHSA-c3rc-7w9v-j8rc

SQLi

9.3

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 10:31 vuln.today

CVE Published

Jul 28, 2026 - 10:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.

AnalysisAI

SQL injection in PROCON-WEB SCADA's GetGridData endpoint allows remote unauthenticated attackers to execute arbitrary SQL commands, compromising the SCADA system's confidentiality, integrity, and availability. No evidence of active exploitation or public exploit code was found at time of analysis, but the vulnerability's network-accessible, low-complexity nature makes exploitation trivial once exposed.