CVE-2026-88020
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding.
Risk Assessment
The vulnerability could allow an attacker to inject malicious code or manipulate the interface, potentially leading to unauthorized access or system damage.
Recommendation
Upgrade OpenPLC to the latest version and apply proper encoding and validation of input parameters.
Other vulnerabilities in OpenPLC
See all- CVE-2026-31156Medium
A path injection vulnerability exists in OpenPLC v3 (commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a). The binary compiled from glue_generator.cpp does not validate file path parameters from the command line, allowing an attacker to read arbitrary files.
- CVE-2025-53476Medium
A denial of service vulnerability exists in the ModbusTCP server functionality of OpenPLC _v3 a931181e8b81e36fadf7b74d5cba99b73c3f6d58. A specially crafted series of network connections can lead to the server not processing subsequent Modbus requests. An attacker can open a series of TCP connections to trigger this vulnerability.
Original NVD description (English source)
Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS