CVE-2025-9388

2.0 lowEPSS 0.3%

A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

2.0 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-94
Published: 2025-08-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

scada-lts:scada-lts

References

https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9388.md
https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored_XSS_endpoint_watch_list.shtm_parameter_name.md#poc
https://vuldb.com/?ctiid.321221
https://vuldb.com/?id.321221
https://vuldb.com/?submit.630800

Check your stack JSON