CVE-2021-26829OpenPLC ScadaBR Cross-site Scripting Vulnerability

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

5.4 MEDIUMEPSS 48.05%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 03:43 UTC

OverviewCVSS details

5.4MEDIUMCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Jun 11, 2021
Assigner: mitre

Affected

scadabr (scadabr)

Versions: through 0.9.1 · through 1.12.4

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Nov 28, 2025
KEV due date: Dec 19, 2025
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact partial

EPSS · FIRST, scored Nov 8

48.05%chance of exploitation in 30 days

Higher than 98.86% of CVEs

CVSS 3.1 · NVD

5.4Medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: Required
Scope: Changed
Confidentiality impact: Low
Integrity impact: Low
Availability impact: None

CVSS 2.0 · NVD

3.5Low

AV:N/AC:M/Au:S/C:N/I:P/A:N

Attack vector: Network
Attack complexity: Medium
Authentication: Single
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
5.4	MEDIUM	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
3.5	LOW	2.0NVD	AV:N/AC:M/Au:S/C:N/I:P/A:N

CISA required action

⚡ Known exploited · remediation due Dec 19, 2025

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2021-26829
Status: Analyzed
Assigner (CNA): mitre
Published: Jun 11, 2021
Last modified: 2026-06-17 03:43 UTC
Weaknesses: CWE-79

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 11:16 UTC.