CVE-2021-29661: Softing Opc Toolbox

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it.

Affected products

• Softing Opc Toolbox: up to and including 4.10.1.13035

Published 2021-04-02. Last modified 2026-06-17.