Cross-Site Scripting Vulnerability in Scada-LTS Reports Module
CVE-2025-10235

4.8MEDIUM

Key Information:

Vendor

Scada-LTS

Status
Scada-lts
Vendor
CVE Published:
11 September 2025

What is CVE-2025-10235?

A vulnerability in Scada-LTS versions up to 2.7.8.1 has been identified, stemming from the erroneous handling of a parameter in the Reports Module's file /reports.shtm. This flaw allows an attacker to perform cross-site scripting by manipulating the 'Colour' argument, which could enable malicious scripts to be executed remotely. The exploit has been publicly disclosed, and the vendor's lack of response regarding this issue raises concerns about potential risks to users.

Affected Version(s)

Scada-LTS 2.7.8.0

Scada-LTS 2.7.8.1

References

https://vuldb.com/?id.323504
vdb-entrytechnical-description
https://vuldb.com/?ctiid.323504
signaturepermissions-required
https://vuldb.com/?submit.641972
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0x5ea3o1f (VulDB User)
.
CVE-2025-10235 : Cross-Site Scripting Vulnerability in Scada-LTS Reports Module