CVE-2026-94148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94148", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-20T21:17:48.199Z", "datePublished": "2026-09-21T07:15:08.516Z", "dateUpdated": "2026-09-21T19:27:19.388Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-21T07:15:08.516Z"}, "title": "ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "n/a", "product": "ScadaBR", "versions": [{"version": "1.0", "status": "affected"}, {"version": "1.1", "status": "affected"}, {"version": "1.2.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:*"], "modules": ["Export Project Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-20T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-20T23:23:29.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "LianAldrich (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/408062", "name": "VDB-408062 | ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/408062/cti", "name": "VDB-408062 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-94148", "name": "CVE-2026-94148 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/894000", "name": "Submit #894000 | ScadaBR 0.9.1 Authentication Bypass Using Alternate Channel", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ScadaBR/ScadaBR/commit/c852b4988a15bce6011ef169299ad604538f70a9", "tags": ["patch"]}, {"url": "https://github.com/ScadaBR/ScadaBR/releases/tag/v1.2", "tags": ["patch"]}, {"url": "https://github.com/ScadaBR/ScadaBR/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/894000", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-21T19:27:13.953014Z", "id": "CVE-2026-94148", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T19:27:19.388Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94148", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T19:27:13.953014Z"}}}], "references": [{"url": "https://vuldb.com/submit/894000", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T19:26:54.119Z"}}], "cna": {"tags": ["x_open-source"], "title": "ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure", "credits": [{"lang": "en", "type": "reporter", "value": "LianAldrich (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Export Project Endpoint"], "product": "ScadaBR", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "unaffected", "version": "1.2.0"}]}], "timeline": [{"lang": "en", "time": "2026-09-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-20T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-20T23:23:29.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/408062", "name": "VDB-408062 | ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/408062/cti", "name": "VDB-408062 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-94148", "name": "CVE-2026-94148 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/894000", "name": "Submit #894000 | ScadaBR 0.9.1 Authentication Bypass Using Alternate Channel", "tags": ["third-party-advisory"]}, {"url": "https://github.com/ScadaBR/ScadaBR/commit/c852b4988a15bce6011ef169299ad604538f70a9", "tags": ["patch"]}, {"url": "https://github.com/ScadaBR/ScadaBR/releases/tag/v1.2", "tags": ["patch"]}, {"url": "https://github.com/ScadaBR/ScadaBR/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-21T07:15:08.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94148", "state": "PUBLISHED", "dateUpdated": "2026-09-21T19:27:19.388Z", "dateReserved": "2026-09-20T21:17:48.199Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-21T07:15:08.516Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:*"], "modules": ["Export Project Endpoint"], "product": "ScadaBR", "vendor": "n/a", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "unaffected", "version": "1.2.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected."}], "id": "CVE-2026-94148", "lastModified": "2026-09-21T20:17:41.100", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94148", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-21T19:27:13.953014Z", "version": "2.0.3"}}]}, "published": "2026-09-21T08:16:38.987", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/ScadaBR/ScadaBR/"}, {"source": "cna@vuldb.com", "url": "https://github.com/ScadaBR/ScadaBR/commit/c852b4988a15bce6011ef169299ad604538f70a9"}, {"source": "cna@vuldb.com", "url": "https://github.com/ScadaBR/ScadaBR/releases/tag/v1.2"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-94148"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/894000"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/408062"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/408062/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://vuldb.com/submit/894000"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.2.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "ScadaBR", "source": "cna", "vendor": "n/a"}, "product": "scadabr", "vendor": "scadabr"}], "created": "2026-09-21T08:30:13.119707+00:00", "updated": "2026-09-21T09:00:10.017914+00:00", "vendors": ["scadabr", "scadabr$PRODUCT$scadabr"]}