CVE-2021-26828

⚠️ high

Summary

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

CVSS Score

8.8

High

EPSS Score

78.6

Exploit Probability

Published Date

2021-06-11

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.1% of all 326,604 vulnerabilities in our database.

#61,754

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Dec 3, 2025

🔍 Exploitation Status

Active

Exploits detected in the wild

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2025-12-04

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-434

📦 Affected Products 2

Vendor	Product	Status	Affected Versions
scadabr	scadabr	Affected	≤ 0.9.1
scadabr	scadabr	Affected	≤ 1.12.4

🔗 References 5

http://forum.scadabr.com.br/t/report-falhas-de-segur...

Broken Link Exploit Vendor Advisory

http://packetstormsecurity.com/files/162564/ScadaBR-...

Exploit Third Party Advisory

https://youtu.be/k1teIStQr1A

Exploit Third Party Advisory

https://github.com/SCADA-LTS/Scada-LTS/pull/2174

Issue Tracking Patch

https://www.cisa.gov/known-exploited-vulnerabilities...

US Government Resource

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-8602	⛔ critical	9.1	0.1	In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated at...	2026-05-19
CVE-2026-8603	⛔ critical	9.8	0.4	In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on t...	2026-05-19
CVE-2026-8604	⚠️ high	8.8	0.0	In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a vic...	2026-05-19
CVE-2026-8605	⛔ critical	9.8	0.1	In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA syst...	2026-05-19
CVE-2025-70973	🔶 medium	4.8	0.1	ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated...	2026-03-09
CVE-2021-26829	🔶 medium	5.4	13.6	OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.	2021-06-11

These CVEs affect the same products