CVE-2021-26828CISA KEV: Actively Exploited

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Published Dec 3, 2025·Updated Dec 3, 2025

Description

OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Public Exploits & PoCs2 found

PoC: CVE-2021-26828-Ultimate

ScadaFlare Authenticated RCE Exploit Framework for ScadaBR (CVE-2021-26828) OpenPLC ScadaBR

PoC: CVE-2021-26828

python3 port of https://github.com/hev0x/CVE-2021-26828_ScadaBR_RCE/blob/main/LinScada_RCE.py

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free