2438 matches found
Advisories
보안 권고 이 저장소에는 침투 테스트 중 발견되어 보고된 여러 취약점이 포함되어 있습니다. 이 저장소의 모든 콘텐츠는 교육 목적으로만 제공됩니다. 링크 https://www.securityweek.com/organizations-notified-of-remotely-exploitable-vulnerabilities-in-aveva-hmi-scada-products/ https://www.cisa.gov/news-events/ics-advisories/icsa-22-342-02...
CVE-2025-69985
FUXA ≤ 1.2.8 Обход аутентификации + RCE CVE-2025-69985 📜 Описание Этот эксплойт на Python нацелен на CVE-2025-69985 — критическую уязвимость обхода аутентификации в FUXA веб-SCADA/HMI-программное обеспечение версиях ≤ 1.2.8. Отправляя специально сформированный JSON-полезную нагрузку со встроенным...
CVE-2025-69985
CVE-2025-69985: Эксплойт обхода аутентификации до RCE в FUXA ≤1.2.8 📌 Общее описание Этот репозиторий содержит Концептуальное доказательство PoC и подробную техническую документацию по уязвимости CVE-2025-69985 , затрагивающей FUXA версии ≤1.2.8. Уязвимость позволяет неаутентифицированному...
FUXAPWN
CVE-2026-25895 — FUXA = 1.2.9 認証なしパストラバーサルによるリモートコード実行 Node.jsベースのSCADA/HMIプラットフォームであるFUXAに対する、認証なし・認証前の任意ファイル書き込み。複数の異なる書き込み後プリミティブを介してリモートコード実行に連鎖します。脆弱なエンドポイントにはミドルウェアが接続されていないため、secureEnabled = true（認証オン）の場合でも機能します。 ExploitDB でも公開されています: https://www.exploit-db.com/exploits/52568 フィールド| 値...
CVE-2026-82789
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
CVE-2026-82789
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
CVE-2026-82789
An Eval Injection vulnerability (improper neutralization of directives in dynamically evaluated code) exists in CONPROSYS HMI System (CHS) by CONTEC. A low-privilege attacker who can log in to the product may achieve arbitrary code execution , leading to high impact on confidentiality, integrity,...
EUVD-2026-77243
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
CVE-2026-82789
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
PT-2026-91093
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
CVE-2026-82789: Improper Neutralization of Directives in Dynamically Evaluated Code
An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...
The vulnerability of the high-performance operator panels from the SIMATIC HMI Unified Comfort Panels Standard family lies in their unsafe initialization of resources, allowing attackers to gain unauthorized access to the web browser.
The vulnerability of the high-performance operator panels from the SIMATIC HMI Unified Comfort Panels Standard family relates to the insecure initialization of resources. Exploiting this vulnerability could allow an intruder to gain unauthorized access to the web browser...
CVE-2026-30512
A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...
CVE-2026-30512
A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...
EUVD-2026-64900
A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...
CVE-2026-30512: Execution with Unnecessary Privileges
A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...
CVE-2026-30512
A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...
PT-2026-80881
Name of the Vulnerable Software and Affected Versions Scheidt & Bachmann entervo HMI versions prior to V2 R5 P0 M5 Description A local privilege escalation issue exists in the Restricted Access Kiosk Mode implementation. An authenticated low-privileged user can escape the kiosk environment by...
CVE-2026-30512
A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI versions prior to V2 R5 P0 M5 . The flaw resides in the external PDF viewer functionality used to display the application manual and its interaction with the un...
CVE-2026-65985
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...