Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 175

Export CSV
CVE-2026-36226

Cross‑Site Scripting in Advantech WebAccess/SCADA Decryption Field Enables Sensitive Data Disclosure

Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via the decryption field in the Create New Project User component

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/scada
CVE-2026-6888

SQL Injection Vulnerability

Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, potentially enabling the attacker to access, modify, or delete sensitive information within the database.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Ecowatch Saas-composer Iot Edge Linux Docker Iot Edge Windows and 5 more
CVE-2024-2453

Advantech WebAccess/SCADA SQL Injection

There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/scada
CVE-2025-14848

Advantech WebAccess/SCADA Absolute Path Traversal

Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/scada Webaccess\/scada
CVE-2025-14849

Advantech WebAccess/SCADA Unrestricted Upload of File with Dangerous Type

Advantech WebAccess/SCADA  is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/scada Webaccess\/scada
CVE-2025-14850

Advantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted Directory

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/scada Webaccess\/scada
CVE-2025-46268

Advantech WebAccess/SCADA SQL Injection

Advantech WebAccess/SCADA  is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/scada Webaccess\/scada
CVE-2025-67653

Advantech WebAccess/SCADA Path Traversal

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/scada Webaccess\/scada
CVE-2025-34239

Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.

CVSS 4.0 · 8.6 High EPSS 1.7% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34238

Advantech WebAccess/VPN < 1.1.5 Path Traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34245

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34247

Advantech WebAccess/VPN < 1.1.5 SQL Injection via NetworksController.addNetworkAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34246

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34244

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxDeviceFwRulesAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34243

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34242

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34241

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34240

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34236

Advantech WebAccess/VPN < 1.1.5 Stored XSS via NetworksController.addNetworkAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn
CVE-2025-34237

Advantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction()

Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Webaccess/vpn Webaccess\/vpn