Scada-LTS Cross-Site Scripting Vulnerability in users.shtm (CVE-2025-7728)

A cross-site scripting (XSS) vulnerability has been identified in Scada-LTS versions through 2.7.8.1. The issue arises in the users.shtm file, where the Username parameter is not properly validated, allowing for the injection of malicious scripts. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed automatically when the users.shtm page is accessed. This could lead to session hijacking, credential theft, and other malicious actions as described in the CVE submission.

Reproduction

To reproduce this vulnerability, register a payload in the username field at the users.shtm endpoint. The cross-site scripting can then be triggered by opening the users.shtm page, which will execute the injected script in the browser.

Remediation

The vendor has confirmed that this vulnerability will be addressed in the upcoming release 2.8.0.