CVE-2026-19657

Name of the Vulnerable Software and Affected Versions ScadaLTS version 2.7.8.1

Description The software reflects user-supplied input into an HTML response without proper sanitization. This allows an unauthenticated attacker to execute arbitrary JavaScript within the victim's browser session by tricking them into visiting a specially crafted URL. This issue is a Reflected Cross-Site Scripting (XSS), which occurs when an application includes untrusted data in a web page without validating or encoding it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.