CVE-2026-115803

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-285CWE-639

Affected software

VendorProductVersions
n/aScada-LTS2.8.0

References

Timeline

Published
Oct 24, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1158069.8The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.CVE-2026-1158077.1The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to LimitedCVE-2026-115815.9The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not sanitise a form field's caption before outputtCVE-2026-1158107.7Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-priviCVE-2026-1158129.8Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actoCVE-2026-1158135.8Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actorCVE-2026-115827.3A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendCVE-2026-115836.3A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendanCVE-2026-115846.3A vulnerability was found in CodeAstro Student Attendance Management System 1.0. This impacts an unknown function of the file /attendance-phCVE-2026-1158456.4An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated rCVE-2026-115856.3A vulnerability was determined in CodeAstro Student Attendance Management System 1.0. Affected is an unknown function of the file /attendancCVE-2026-115867.5By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged