CVE-2026-34185CWE-89sql-injection

CVE-2026-34185

High · published April 9, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database.

This issue was fixed in AlanWeb SCADA version 9.8.5

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00466 · 39.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-09T14:16Z
Affected products (1)
ProductVersionsFixed in
hydrosystem.poznan/control_system< 9.8.59.8.5
References (2)
https://cert.pl/posts/2026/04/CVE-2026-4901/ · [email protected]https://control-system.pl/ · [email protected]
EPSS history
Timeline
  • 09 APR 09:41Z
    SQL Injection in Hydrosystem Control System
    cvelistv5