CVE-2026-94148

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-94148

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94148.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-94148

Published

2026-09-21T07:15:08Z

Modified

2026-09-23T08:05:33Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure

Details

A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-200",
        "CWE-284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94148.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "1.0"
                },
                {
                    "last_affected":  "1.0"
                },
                {
                    "introduced":  "1.1"
                },
                {
                    "last_affected":  "1.1"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/scadabr/scadabr

Affected ranges

Type

GIT

Repo

https://github.com/scadabr/scadabr

Events

Introduced

Fixed

c852b4988a15bce6011ef169299ad604538f70a9

Fixed

6e93943eb4ba9fb09ae7de38f339ddb54350ff0e

Database specific

Show details

{
    "source":  "REFERENCES"
}

Affected versions

Other

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94148.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "59500543605688069670777011287339686379",
            "length":  2712
        },
        "id":  "CVE-2026-94148-642447da",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/scadabr/scadabr/commit/c852b4988a15bce6011ef169299ad604538f70a9",
        "target":  {
            "file":  "src/com/serotonin/mango/web/dwr/EmportDwr.java",
            "function":  "createExportJSON"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "150109897361551265718672396936610073239",
                "266990229212540813646091226071476351879",
                "230005262118526281793938556036445289130",
                "25035305573603967503394644560086987209",
                "101714950490241538507878093241512231748",
                "89868389574514710295842034562803297657",
                "108599110921973635117093298357690061285"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-94148-74e885d7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/scadabr/scadabr/commit/c852b4988a15bce6011ef169299ad604538f70a9",
        "target":  {
            "file":  "src/com/serotonin/mango/web/dwr/EmportDwr.java"
        }
    }
]

vanir_signatures_modified

"2026-09-23T08:05:33Z"