https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T21:38:52.837734+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-25786 CVE-2026-25786 2026-09-29T21:38:52.852175+00:00

Affected: Siemens SIMATIC Drive Controller CPU 1504D TF, Siemens SIMATIC Drive Controller CPU 1507D TF, Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1510SP-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN, Siemens SIMATIC ET 200SP CPU 1512SP-1 PN, Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN, Siemens SIMATIC ET 200SP CPU 1514SP-2 PN, Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN, Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN and 92 more

Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a benign user with appropriate rights accesses the "communication" parameters page, the malicious code would be executed in the scope of their web session.

 https://db.gcve.eu/vuln/ssa-688146 SSA-688146 — SSA-688146: Multiple Cross-Site Scripting Vulnerabilities in SIMATIC S7 PLCs Web Server 2026-09-29T21:38:52.852535+00:00

SIMATIC S7 PLCs contain multiple vulnerabilities in the web server that could allow an attacker to perform cross-site scripting attacks.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.