{"id":"CVE-2026-115328","kind":"vulnerability","aliases":["CVE-2026-115328"],"related":[],"title":"JSON-SCADA: SQL injection in opcApi lets users alter historian data","description":"JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.","summary":"JSON-SCADA before 0.65-alpha has a SQL injection in its opcApi() handler, reached through NodeId.Id, StartTime and EndTime values in HistoryReadRequest. An logged-in user can read, modify or delete historian data for every location, regardless of role.","severity":"high","cvss":8.8,"epss":0.0029,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["historian","industrial-control","json-scada","node.js","other","scada"],"not_affected_if":["no-authenticated-users","version-0.65-alpha-or-later"],"how_to_check":"Check the installed JSON-SCADA version and confirm it is below 0.65-alpha.","fix":"Upgrade JSON-SCADA to 0.65-alpha or later.","status":"open","published_at":"2026-10-22T11:17:51+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:26+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:32:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade JSON-SCADA to 0.65-alpha or later.\nunknown","reach":"network","title":"JSON-SCADA: SQL injection in opcApi lets users alter historian data","impact":"high","summary":"JSON-SCADA before 0.65-alpha has a SQL injection in its opcApi() handler, reached through NodeId.Id, StartTime and EndTime values in HistoryReadRequest. An logged-in user can read, modify or delete historian data for every location, regardless of role.","category":"other","who_cares":["json-scada","scada","node.js","industrial-control"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads, changes or deletes all historian data across locations.","analyst_note":"Confirm the affected version range and whether a patched release or advisory exists at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-115328) or the JSON-SCADA repository.","how_to_check":"Check the installed JSON-SCADA version and confirm it is below 0.65-alpha.\nunknown","needs_analyst":true,"not_affected_if":["version-0.65-alpha-or-later","no-authenticated-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000525,"input_tokens":2963,"output_tokens":458,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115328':15A,18A '-2026':14A,17A '0.65':33B,74C 'across':113C 'allow':86C 'alpha':34B,75C 'alter':10A 'attack':95C 'authent':87C 'contain':76C 'control':22B 'cve':13A,16A 'data':12A,63B,112C 'delet':61B,110C 'endtim':48B,104C 'everi':65B 'handler':42B 'historian':11A,19B,62B,111C 'historyreadrequest':51B,93C 'industri':21B 'industrial-control':20B 'inject':5A,38B,79C,90C,97C 'json':2A,24B,30B,71C 'json-scada':1A,23B,29B,70C 'let':8A 'locat':66B,115C 'log':54B 'logged-in':53B 'modifi':59B,108C 'node.js':26B 'nodeid.id':45B,101C 'opcapi':7A,41B,82C 'paramet':94C 'reach':43B 'read':58B,107C 'regardless':67B,116C 'role':69B,118C 'scada':3A,25B,28B,31B,72C 'sql':4A,37B,78C,91C 'src/server_realtime_auth/index.js':84C 'stack':98C 'starttim':46B,102C 'statement':99C 'user':9A,56B,88C 'valu':49B,105C 'via':92C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115328","severity":null,"published_at":"2026-10-22T11:17:51+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115328","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115328","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}