SQL Injection Vulnerability in JSON-SCADA by Riclo Olsen

CVE-2026-115328

What is CVE-2026-115328?

JSON-SCADA prior to version 0.65-alpha is susceptible to an SQL injection vulnerability within the opcApi() function. Authenticated users may exploit this flaw by injecting malicious SQL queries through HistoryReadRequest parameters—namely NodeId.Id, StartTime, or EndTime. This can lead to unauthorized access to sensitive historian data, enabling attackers to read, modify, or delete records across the entire system without appropriate role restrictions.

References