Medium severity · published Sep 11, 2025
CVE-2025-10235
Scada-LTS Reports reports.shtm cross site scripting
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This manipulation of the argument Colour causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Scada-LTS ·
2.7.8.0; 2.7.8.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10235
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10235
Exploit
https://medium.com/@warlleyfreire/stored-xss-in-scada-lts-reports-module-colour-field-4d7e6633d298
Permissions Required
https://vuldb.com/?ctiid.323504
Third Party Advisory
https://vuldb.com/?id.323504
Third Party Advisory
https://vuldb.com/?submit.641972
More from Scada-LTS
6.5
CVE-2025-9139
Scada-LTS WatchListDwr.init.dwr information disclosure
5.4
CVE-2025-9404
Scada-LTS Folder pointHierarchySLTS cross site scripting
5.4
CVE-2025-9388
Scada-LTS watch_list.shtm cross site scripting
5.4
CVE-2025-9235
Scada-LTS compound_events.shtm cross site scripting
5.4
CVE-2025-9234
Scada-LTS maintenance_events.shtm cross site scripting