JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters.
CVSS 4.0HIGH 8.7·Network·Low privileges·No interaction·EPSS 0.0029·Published 2026-10-22·Fixed in 0.65-alphaCWE-89