CVE-2026-34184

CriticalCVSS 9.1/10Last modified Aug 13, 2026

Description

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database.

This issue was fixed in AlanWeb SCADA version 9.8.5

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2026
Last modified: Aug 13, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-341858.8AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated CVE-2026-341868.8Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects CVE-2026-341879.8Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This is CVE-2026-341887.2Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. Th CVE-2026-341895.9Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticat CVE-2026-34195.3Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 911 CVE-2026-341905.9Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when CVE-2026-341919.1Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via ap CVE-2026-341927.7Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page CVE-2026-341934.3Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outsi CVE-2026-341947.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintain CVE-2026-341958.8Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the