Low severity3.5NVD Advisory· Published Aug 20, 2025· Updated Apr 29, 2026

CVE-2025-9235

Description

A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Scada Lts/SCADA Lts2 versions
cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*range: <=2.7.8.1
- (no CPE)range: <=2.7.8.1

Patches

Vulnerability mechanics

References

github.com/marcelomulder/CVE/blob/main/Scada-LTS/CVE-2025-9235.mdnvdExploitThird Party Advisory
vuldb.comnvdThird Party AdvisoryVDB Entry
vuldb.comnvdThird Party AdvisoryVDB Entry
github.com/marcelomulder/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20compound_events.shtm%20parameter%20name.mdnvdBroken Link
vuldb.comnvdPermissions RequiredVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.227
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000