CVE-2021-26829 OpenPLC ScadaBR Cross-site Scripting
Attackers can inject malicious scripts into the system settings page, potentially compromising user sessions and executing code in the victim's browser.
- Exploited in the wild
- Since 28 Nov 2025
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-26829?
CVE-2021-26829 is a medium-severity cross-site scripting vulnerability in n/a, published on 11 Jun 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
Weakness: CWE-79
Which versions are affected by CVE-2021-26829?
It affects 1 product.
Products include Scadabr Scadabr.
How do I fix CVE-2021-26829?
No fix has been published for CVE-2021-26829 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 19 Dec 2025.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-26829 being exploited?
Yes. Attackers have exploited CVE-2021-26829 in the wild since at least 28 Nov 2025.
Other vulnerabilities in n/a
- CVE-2021-26828 OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type
- CVE-2026-9645 ScadaBR Authenticated Remote Code Execution
- CVE-2026-8602 Missing authentication for critical function in ScadaBR
- CVE-2026-8603 Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR
- CVE-2026-8604 Cross-Site request forgery (CSRF) in ScadaBR
Sources
Also known as GHSA-6pvv-xrf9-29m6.