CVE-2026-63353

CriticalCVSS 9.6/10Last modified Oct 15, 2026

Description

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-633549.6Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the T CVE-2026-633556.1Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the CVE-2026-633566.1Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messa CVE-2026-633576.1Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Tr CVE-2026-633587.3FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()CVE-2026-633599.8The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a spec CVE-2026-63365.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 th CVE-2026-633607.4LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation conf CVE-2026-633618.5LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint.CVE-2026-633625.9An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of servi CVE-2026-633734.2draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/co CVE-2026-633749.3AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connec