CVE-2025-9143

2.0 lowEPSS 0.4%

Low (2.0) in scada-lts scada-lts. EPSS 0.4% chance of exploitation in the next 30 days.

A security flaw has been discovered in Scada-LTS 2.7.8.1. This affects an unknown part of the file mailing_lists.shtm. The manipulation of the argument name/userList/address results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-94
Published: 2025-08-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

scada-lts:scada-lts

References

https://karinagante.github.io/cve-2025-9143/
https://karinagante.github.io/cve-2025-9143/#proof-of-concept-poc
https://vuldb.com/?ctiid.320521
https://vuldb.com/?id.320521
https://vuldb.com/?submit.628437

Check your stack JSON