Live › vulnerability › CVE-2026-115328
Go to dashboardJSON-SCADA before 0.65-alpha has a SQL injection in its opcApi() handler, reached through NodeId.Id, StartTime and EndTime values in HistoryReadRequest. An logged-in user can read, modify or delete historian data for every location, regardless of role.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed JSON-SCADA version and confirm it is below 0.65-alpha.
Upgrade JSON-SCADA to 0.65-alpha or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.
This page as .md · .json · in your agent: get_signal("CVE-2026-115328")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.