OpenPLC ScadaBR Cross-site Scripting Vulnerability

Description

References

• forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4 · Vendor Advisory
• youtu.be/Xh6LPCiLMa8 · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• forescout.com/blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics · Third Party Advisory
• CISA KEV · CVE-2021-26829

Weitere Schwachstellen in scadabr

• CVE-2026-9646MITTEL 6.1A reflected cross-site scripting issue exists in URL handling.
• CVE-2026-9645KRITISCH 9.9Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full acces…
• CVE-2026-8605KRITISCH 9.8In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
• CVE-2026-8604HOCH 8.8In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by lur…
• CVE-2026-8603KRITISCH 9.8In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.