CVE-2025-69985

CVE-2025-69985: Эксплойт обхода аутентификации до RCE в FUXA ≤1.2.8 📌 Общее описание Этот репозиторий содержит Концептуальное доказательство PoC и подробную техническую документацию по уязвимости CVE-2025-69985 , затрагивающей FUXA версии ≤1.2.8. Уязвимость позволяет неаутентифицированному...

FUXAPWN

CVE-2026-25895 — FUXA = 1.2.9: неаутентифицированный обход пути Path Traversal, ведущий к удалённому выполнению кода Неаутентифицированная pre-auth произвольная запись файлов в FUXA — SCADA/HMI-платформе на базе Node.js. Цепочка доводится до удалённого выполнения кода через несколько отдельных...

PT-2026-107257

Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...

Advisories

Уведомления о безопасности Этот репозиторий содержит несколько уязвимостей, которые были обнаружены и описаны в ходе тестов на проникновение. Весь контент данного репозитория предоставлен исключительно в образовательных целях. Ссылки...

CVE-2025-69985

FUXA ≤ 1.2.8 Обход аутентификации + RCE CVE-2025-69985 📜 Описание Этот эксплойт на Python нацелен на CVE-2025-69985 — критическую уязвимость обхода аутентификации в FUXA веб-SCADA/HMI-программное обеспечение версиях ≤ 1.2.8. Отправляя специально сформированный JSON-полезную нагрузку со встроенным...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An Eval Injection vulnerability (improper neutralization of directives in dynamically evaluated code) exists in CONPROSYS HMI System (CHS) by CONTEC. A low-privilege attacker who can log in to the product may achieve arbitrary code execution , leading to high impact on confidentiality, integrity,...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

EUVD-2026-77243

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

PT-2026-91093

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

CVE-2026-82789: Improper Neutralization of Directives in Dynamically Evaluated Code

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...

The vulnerability of the high-performance operator panels from the SIMATIC HMI Unified Comfort Panels Standard family lies in their unsafe initialization of resources, allowing attackers to gain unauthorized access to the web browser.

The vulnerability of the high-performance operator panels from the SIMATIC HMI Unified Comfort Panels Standard family relates to the insecure initialization of resources. Exploiting this vulnerability could allow an intruder to gain unauthorized access to the web browser...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

EUVD-2026-64900

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

CVE-2026-30512: Execution with Unnecessary Privileges

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access (Kiosk) Mode implementation of Scheidt & Bachmann entervo HMI versions prior to V2 R5 P0 M5 . The flaw resides in the external PDF viewer functionality used to display the application manual and its interaction with the un...

PT-2026-80881

Name of the Vulnerable Software and Affected Versions Scheidt & Bachmann entervo HMI versions prior to V2 R5 P0 M5 Description A local privilege escalation issue exists in the Restricted Access Kiosk Mode implementation. An authenticated low-privileged user can escape the kiosk environment by...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...