https://pwn.watch/t/openplc Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 03 Dec 2025 00:00:00 GMT https://pwn.watch/i/openplc-scadabr-cve-2021-26828 https://pwn.watch/i/openplc-scadabr-cve-2021-26828 Wed, 03 Dec 2025 00:00:00 GMT high <p>OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Added to CISA KEV on 2025-12-03.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-12-03: CISA added CVE-2021-26828 to the KEV catalog (due 2025-12-24).</li></ul> <p><strong>CVEs:</strong> CVE-2021-26828</p> https://pwn.watch/i/openplc-scadabr-cve-2021-26829 https://pwn.watch/i/openplc-scadabr-cve-2021-26829 Fri, 28 Nov 2025 00:00:00 GMT medium <p>OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm. Added to CISA KEV on 2025-11-28.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-11-28: CISA added CVE-2021-26829 to the KEV catalog (due 2025-12-19).</li></ul> <p><strong>CVEs:</strong> CVE-2021-26829</p>