CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability

Medium severity, CVSS 5.4. Actively exploited: in CISA KEV since 2025-11-28. EPSS: 48.1% chance of exploitation in the next 30 days.

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

Affected products

• ScadaBR ScadaBR: up to and including 0.9.1; up to and including 1.12.4

Published 2021-06-11. Last modified 2026-06-17.