Actively exploited in the wild
OpenPLC ScadaBR Cross-site Scripting Vulnerability
OpenPLC - ScadaBR · Listed in the CISA KEV since 2025-11-28. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2021-26829
MediumCVSS 5.4KEVSummary
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Risk Assessment
An attacker can inject malicious script that executes in the victim's browser, potentially leading to session theft or other actions in the user's context.
Recommendation
Update OpenPLC ScadaBR to a version later than 0.9.1 (Linux) or 1.12.4 (Windows) or apply XSS mitigations.
Other vulnerabilities in OpenPLC ScadaBR
Original NVD description (English source)
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.