CVE-2021-26829
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
OpenPLC ScadaBR has a stored cross-site scripting (XSS) vulnerability in its system settings page. An attacker can inject malicious scripts that get saved and executed when other users view the settings, potentially stealing their credentials or session data.
Stored XSS vulnerability in system_settings.shtm allows authenticated or unauthenticated attackers to inject arbitrary JavaScript that persists in the application database. When administrators or other users access the affected page, the malicious script executes in their browser context, enabling session hijacking, credential theft, or further compromise of the SCADA system.
The full analysis of this CVE is available in Portuguese →