Actively exploited vulnerabilities affecting OpenPLC products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2021-26828https://wildfortech.com/security#CVE-2021-26828This vulnerability in OpenPLC's ScadaBR allows any authenticated user to upload and execute arbitrary JSP files through a specific endpoint. In industrial control and SCADA environments, this is especially serious: an attacker with even low-level credentials can effectively take full control of the server, potentially manipulating or disrupting industrial processes. The fact that it requires authentication provides only a thin barrier, since credentials can be stolen, guessed, or obtained through phishing.Wed, 03 Dec 2025 00:00:00 GMTOpenPLCScadaBRhttps://wildfortech.com/security#CVE-2021-26829https://wildfortech.com/security#CVE-2021-26829This cross-site scripting (XSS) vulnerability in OpenPLC's ScadaBR affects the system_settings.shtm page, a component used in industrial control and SCADA environments. An attacker who can deliver a malicious script through this endpoint could potentially hijack authenticated user sessions, steal credentials, or manipulate what operators see on their HMI dashboards. Because SCADA systems often control physical processes, compromised operator interfaces carry risks beyond typical IT environments.Fri, 28 Nov 2025 00:00:00 GMTOpenPLCScadaBR