All vulnerabilities
CVE-2026-115328

JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

riclolsen json-scadaIndustrial & IoT
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0.65-alphaFixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.

Text from CVE List

Affected versions 2

  • json-scadaaffected: all versions before 0.65-alphaCVE List
  • json-scadaunaffected: 0.65-alphaCVE List

References 5