CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
OpenPLC ScadaBR Stored Cross-Site Scripting (XSS) Vulnerability (CVE-2021-26829) Security Advisory
[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows
[Impact] Attackers can inject malicious scripts permanently via system_settings.shtm, leading to administrator session hijacking and unauthorized SCADA control
[Mitigation] Apply the latest security patches, restrict external access, and deploy Web Application Firewall (WAF) rules to sanitize input parameters
OpenPLC ScadaBR Arbitrary File Upload and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2021-26828)
[Affected Scope] OpenPLC ScadaBR through version 0.9.1 on Linux and through version 1.12.4 on Windows
[Impact] Remote authenticated attackers can upload and execute malicious JSP files, leading to complete system compromise and arbitrary code execution
[Mitigation] Apply the latest security patches, restrict external access to the ScadaBR interface, and block unauthorized JSP uploads via WAF rules