CVE-2025-9139

A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower."

• CWE-200
• CWE-284

• https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/%20CVE-2025-9139.mdBroken Link
• https://vuldb.com/?ctiid.320519Permissions Required, VDB Entry
• https://vuldb.com/?id.320519Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.621062Third Party Advisory, VDB Entry
• https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Sensitive%20User%20Information%20Disclosure%20via%20WatchListDwr.init.dwr%20Endpoint.md#proof-of-concept-pocBroken Link
• https://vuldb.com/?submit.621062Third Party Advisory, VDB Entry

Published

Aug 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9133A missing authorization vulnerability in Zyxel ATP series fi…8.1
• CVE-2025-9134A security vulnerability has been detected in AfterShip Pack…5.5
• CVE-2025-9135A vulnerability was detected in Verkehrsauskunft Österreich …5.5
• CVE-2025-9136A flaw has been found in libretro RetroArch 1.18.0/1.19.0/1.…7.8
• CVE-2025-9137A vulnerability has been found in Scada-LTS 2.7.8.1. This im…4.8
• CVE-2025-9138A vulnerability was found in Scada-LTS 2.7.8.1. Affected is …5.4
• CVE-2025-9140A vulnerability was identified in Shanghai Lingdang Informat…8.8
• CVE-2025-9142A local user can trigger Harmony SASE Windows client to writ…7.5
• CVE-2025-9143A security flaw has been discovered in Scada-LTS 2.7.8.1. Th…5.4
• CVE-2025-9144A weakness has been identified in Scada-LTS 2.7.8.1. This vu…5.4
• CVE-2025-9145A security vulnerability has been detected in Scada-LTS 2.7.…5.4
• CVE-2025-9146A flaw has been found in Linksys E5600 1.1.0.26. The affecte…8.1