CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability

Medium severity · published Jun 11, 2021

CVE-2021-26829

OpenPLC ScadaBR Cross-site Scripting Vulnerability

In wildKEV

5.4

CVSS

48%

EPSS

Yes

On KEV

Description

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)48.0% · higher than 99% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 28, 2025

Federal remediation dueDec 19, 2025

Ransomware campaign useNot known

Affected products

Which versions

Scadabr · Scadabr

through 0.9.1; through 1.12.4 · source: NVD, KEV

In the news

VulnerabilityMedium

[CISA KEV] CVE-2021-26829: OpenPLC ScadaBR - OpenPLC ScadaBR Cross-site Scripting Vulnerability

OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.

SCScadaBRCVE-2021-26829

Nov 28, 2025·CISA KEV

Affected product

Scadabr

All Scadabr CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-26829

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-26829

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

x_refsource_MISC

https://youtu.be/Xh6LPCiLMa8

x_refsource_MISC

http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4