CVE-2026-115328: JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who can send OPC HistoryRead API requests may exploit it. The described impact applies across all locations regardless of the user's assigned role.
Which request fields are vulnerable?
The vulnerable HistoryReadRequest parameters are NodeId.Id, StartTime, and EndTime. The issue permits injection of stacked SQL statements through these values.
What is the impact if exploitation succeeds?
An attacker can read, modify, or delete historian data. The CVSS vector indicates network-reachable exploitation with low complexity and no user interaction, but authentication is required.
Which versions need remediation?
JSON-SCADA versions before 0.65-alpha are affected. Updating to 0.65-alpha or later addresses the stated affected-version range.