CVE-2021-26829

🔶 medium

🔍 Scan for this CVE

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

CVSS Score

5.4

Medium

EPSS Score

13.6

Exploit Probability

Published Date

2021-06-11

First Seen: 2026-01-05

This CVE is Lower Risk - more severe than 22.8% of all 326,604 vulnerabilities in our database.

#252,020

Below average severity

Severity Percentile

🔍 Exploitation Status

Active

Exploits detected in the wild

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2025-12-01

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE IDs (Weakness Types)

CWE-79

📦 Affected Products 2

Vendor	Product	Status	Affected Versions
scadabr	scadabr	Affected	≤ 0.9.1
scadabr	scadabr	Affected	≤ 1.12.4

Vendor Advisory

https://youtu.be/Xh6LPCiLMa8

Exploit Third Party Advisory

US Government Resource

Third Party Advisory

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-8602	⛔ critical	9.1	0.1	In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated at...	2026-05-19
CVE-2026-8603	⛔ critical	9.8	0.4	In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on t...	2026-05-19
CVE-2026-8604	⚠️ high	8.8	0.0	In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a vic...	2026-05-19
CVE-2026-8605	⛔ critical	9.8	0.1	In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA syst...	2026-05-19
CVE-2025-70973	🔶 medium	4.8	0.1	ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated...	2026-03-09
CVE-2021-26828	⚠️ high	8.8	78.6	OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and exe...	2021-06-11

These CVEs affect the same products