CVE-2026-34185High· 8.8▾ TwilightAlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.5%
AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database.
This issue was fixed in AlanWeb SCADA version 9.8.5
control_system < 9.8.5Upgrade past the affected range:
control_system 9.8.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4901Medium· 6.5AlanWeb SCADA saves sensitive information into a log file
CVE-2026-34184Critical· 9.1AlanWeb SCADA does not enforce authorization for some directories
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0
CVE-2025-10405High· 7.3A vulnerability was determined in itsourcecode Baptism Information Management System 1.0
CVE-2025-10479High· 7.3A security flaw has been discovered in SourceCodester Online Student File Management System 1.0
CVE-2025-10387Medium· 6.3A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1