{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-9404","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2025-08-24T15:04:20.123Z","datePublished":"2025-08-25T02:32:06.446Z","dateUpdated":"2025-08-25T16:40:58.638Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2025-08-25T02:32:06.446Z"},"title":"Scada-LTS Folder pointHierarchySLTS cross site scripting","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-79","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"type":"CWE","cweId":"CWE-94","lang":"en","description":"Code Injection"}]}],"affected":[{"vendor":"n/a","product":"Scada-LTS","versions":[{"version":"2.7.8.0","status":"affected"},{"version":"2.7.8.1","status":"affected"}],"modules":["Folder Handler"]}],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder Handler. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used."},{"lang":"de","value":"Eine Schwachstelle wurde in Scada-LTS bis 2.7.8.1 gefunden. Es geht dabei um eine nicht klar definierte Funktion der Datei /pointHierarchySLTS der Komponente Folder Handler. Durch Beeinflussen des Arguments Title mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"timeline":[{"time":"2025-08-24T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-24T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-08-24T17:09:23.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"nmmorette (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.321240","name":"VDB-321240 | Scada-LTS Folder pointHierarchySLTS cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.321240","name":"VDB-321240 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.633445","name":"Submit #633445 | SCADA-LTS Scada-LTS 2.7.8.1 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md","tags":["related"]},{"url":"https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md#poc","tags":["exploit"]}]},"adp":[{"references":[{"url":"https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md#poc","tags":["exploit"]},{"url":"https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md","tags":["exploit"]},{"url":"https://vuldb.com/?submit.633445","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-25T16:40:52.309577Z","id":"CVE-2025-9404","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-08-25T16:40:58.638Z"}}]}}