CVE-2026-9646

🔶 medium

A reflected cross-site scripting issue exists in URL handling.

CVSS Score

6.1

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-05-28

First Seen: 2026-05-29

This CVE is Lower Risk - more severe than 37.4% of all 365,890 vulnerabilities in our database.

#229,149

Below average severity

Severity Percentile

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Derrie Sutton with Tenable

SSVC data provided by CISA

Last Modified 2026-08-17

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE IDs (Weakness Types)

CWE-80

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
scadabr	scadabr	Affected	v1.2

Third Party Advisory

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-9645	⛔ critical	9.9	0.3	Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts exe...	2026-05-28
CVE-2026-8602	⛔ critical	9.1	0.5	In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated at...	2026-05-19
CVE-2026-8603	⛔ critical	9.8	1.3	In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on t...	2026-05-19
CVE-2026-8604	⚠️ high	8.8	0.2	In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a vic...	2026-05-19
CVE-2026-8605	⛔ critical	9.8	0.4	In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA syst...	2026-05-19
CVE-2025-70973	🔶 medium	4.8	0.1	ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated...	2026-03-09

These CVEs affect the same products