CVE-2025-9388

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
n/a	Scada-LTS	2.7.8.0; 2.7.8.1

References

https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9388.mdExploit, Third Party Advisory
https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored_XSS_endpoint_watch_list.shtm_parameter_name.md#pocBroken Link
https://vuldb.com/?ctiid.321221Permissions Required, VDB Entry
https://vuldb.com/?id.321221Third Party Advisory, VDB Entry
https://vuldb.com/?submit.630800Third Party Advisory, VDB Entry
https://github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9388.mdExploit, Third Party Advisory
https://vuldb.com/?submit.630800Third Party Advisory, VDB Entry

Timeline

Published: Aug 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-93895.5A vulnerability was identified in vim 9.1.0000. Affected is the function __memmove_avx_unaligned_erms of the file memmove-vec-unaligned-erms CVE-2025-93905.5A security flaw has been discovered in vim up to 9.1.1615. Affected by this vulnerability is the function main of the file src/xxd/xxd.c of CVE-2025-93919.8A weakness has been identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this issue is the function getFieldValue of the component com.ar CVE-2025-93928.8A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.CVE-2025-93938.8A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.0 CVE-2025-93945.5A flaw has been found in PoDoFo 1.1.0-dev. This issue affects the function PdfTokenizer::DetermineDataType of the file src/podofo/main/PdfTo CVE-2025-93956.3A vulnerability was identified in wangsongyan wblog 0.0.1. This affects the function RestorePost of the file backup.go. Such manipulation of CVE-2025-93965.5A security flaw has been discovered in ckolivas lrzip up to 0.651. This impacts the function __GI_____strtol_l_internal of the file strtol_l CVE-2025-93979.8A weakness has been identified in givanz Vvveb up to 1.0.7.2. Affected is an unknown function of the file /system/traits/media.php. Executin CVE-2025-93987.5A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of t CVE-2025-93998.8A vulnerability was detected in YiFang CMS up to 2.0.5. Affected by this issue is some unknown functionality of the file app/logic/L_tool.ph CVE-2025-94008.8A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php