CVE-2025-24865

The administrative web interface ofmySCADA myPRO Manager can be accessed without authenticationwhich could allow an unauthorized attacker to retrieve sensitiveinformation and upload files without the associated password.

CVE-2025-25067

mySCADA myPRO Manager is vulnerable to an OS command injection which could allow a remote attacker to execute arbitrary OS commands.

CVE-2025-22896

mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.

CVE-2025-23411

mySCADA myPRO Manageris vulnerable to cross-site request forgery (CSRF), which could allowan attacker to obtain sensitive information. An attacker would need totrick the victim in to visiting an attacker-controlled website.