CVE-2026-34185

HighCVSS 8.8/10Last modified Oct 26, 2026

Description

AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database.

This issue was fixed in AlanWeb SCADA version 9.8.5

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Control System	AlanWeb SCADA	< 9.8.5

References

https://cert.pl/posts/2026/04/CVE-2026-4901/Vendor Advisory
https://control-system.pl/

Timeline

Published: Apr 9, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-341868.8Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects CVE-2026-341879.8Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This is CVE-2026-341887.2Improper Neutralization of Special Elements used in an OS Command vulnerability allows OS Command Injection via Event Response execution. Th CVE-2026-341895.9Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticat CVE-2026-34195.3Fastify incorrectly accepts malformed `Content-Type` headers containing trailing characters after the subtype token, in violation of RFC 911 CVE-2026-341905.9Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when CVE-2026-341919.1Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via ap CVE-2026-341927.7Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page CVE-2026-341934.3Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outsi CVE-2026-341947.1Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintain CVE-2026-341958.8Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the CVE-2026-341967.8Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an integer overflow and map two GPU virtu