EUVD-2026-31474
GHSA-jgfx-4prm-49vg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable reflected XSS; attacker needs no credentials (PR:N); victim must interact (UI:R); scope changes to browser context; no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via the decryption field in the Create New Project User component
AnalysisAI
Cross-site scripting in Advantech WebAccess/SCADA 8.0 (build 2015.08.16) enables remote unauthenticated attackers to inject malicious JavaScript via the decryption field of the Create New Project User component, targeting authenticated SCADA operators who interact with a crafted request. The CVSS Scope:Changed metric confirms the injected payload executes in the victim's browser context, enabling session token theft, credential harvesting, or interface manipulation against industrial control system operators. A public proof-of-concept exists at GitHub; exploitation is not confirmed in CISA KEV and the EPSS score of 0.04% (11th percentile) reflects very low current exploitation activity.
Technical ContextAI
Advantech WebAccess/SCADA is a browser-based HMI/SCADA platform used for industrial process monitoring and control, making it a high-value target in OT/ICS environments. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied input to the 'decryption field' within the Create New Project User component is insufficiently sanitized before being rendered in the browser. This allows attacker-controlled content to be interpreted as executable JavaScript. The Scope:Changed (S:C) CVSS attribute is significant: it indicates the injected script breaks out of the application's security context and executes within the victim's browser origin, a characteristic of reflected or stored XSS with cross-origin consequence. The NVD CPE data (cpe:2.3:a:n/a:n/a) is non-specific and does not enumerate a vendor-qualified CPE string, limiting automated asset correlation. The affected build is dated 2015.08.16, indicating a legacy release of the platform.
RemediationAI
Organizations running Advantech WebAccess/SCADA 8.0 (build 2015.08.16) should upgrade to a current, vendor-supported release of WebAccess/SCADA - no specific patched version number is confirmed in the available reference data, so contact Advantech directly for the applicable patch version. No vendor-released patch has been independently verified from the provided references; monitor the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-36226 and the ENISA EUVD entry EUVD-2026-31474 for updates. As a primary compensating control, restrict network access to the WebAccess/SCADA web interface to trusted internal network segments or VPN-only, preventing external unauthenticated actors from delivering crafted payloads to authenticated operators - note this reduces but does not eliminate insider or lateral-movement scenarios. Additionally, deploying a Content Security Policy (CSP) header via a reverse proxy to restrict inline script execution would reduce the impact of any XSS, though this requires care not to break legitimate WebAccess UI functionality. Train SCADA operators to be alert to unsolicited or unexpected links referencing the platform's user management components.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today