CVE-2021-26828

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4Broken Link, Exploit, Vendor Advisory
http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.htmlExploit, Third Party Advisory
https://youtu.be/k1teIStQr1AExploit, Third Party Advisory
http://forum.scadabr.com.br/t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4Broken Link, Exploit, Vendor Advisory
http://packetstormsecurity.com/files/162564/ScadaBR-1.0-1.1CE-Linux-Shell-Upload.htmlExploit, Third Party Advisory
https://youtu.be/k1teIStQr1AExploit, Third Party Advisory
https://github.com/SCADA-LTS/Scada-LTS/pull/2174Issue Tracking, Patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26828US Government Resource

Timeline

Published: Jun 11, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Dec 3, 2025
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-268295.4OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.CVE-2021-268309.1SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplish CVE-2021-268326.1Cross Site Scripting (XSS) in the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute java CVE-2021-268335.9Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows attacker who can locally CVE-2021-268345.4A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code execution will happen immedi CVE-2021-268356.1No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution CVE-2021-268379.8SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers t CVE-2021-268437.5An issue was discovered in sthttpd through 2.27.1. On systems where the strcpy function is implemented with memcpy, the de_dotdot function m CVE-2021-268445.4A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script o CVE-2021-268457.5Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used t CVE-2021-268546.6Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2021-268559.1Microsoft Exchange Server Remote Code Execution Vulnerability