Scadabr
Scadabr: vulnerabilidades y CVE
Scadabr tiene 12 vulnerabilidades publicadas, 8 de ellas en los últimos 12 meses. 1 son críticas y 2 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses8
Críticas1
Explotadas activamente2
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-26828 | Alta (8.8) | 39% | ⚠ Explotación activa | 11 jun 2021 | OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. |
| CVE-2021-26829 | Media (5.4) | 48% | ⚠ Explotación activa | 11 jun 2021 | OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-94148 | Media (5.5) | 0.54% | — | 21 sept 2026 | A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes… |
| CVE-2026-9646 | Media (6.1) | 0.26% | — | 28 may 2026 | A reflected cross-site scripting issue exists in URL handling. |
| CVE-2026-9645 | Crítica (9.9) | 0.52% | — | 28 may 2026 | Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root. |
| CVE-2026-8605 | Media (5.1) | 0.50% | — | 19 may 2026 | In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin. |
| CVE-2026-8604 | Alta (8.6) | 0.21% | — | 19 may 2026 | In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage. |
| CVE-2026-8603 | Alta (8.7) | 2.1% | — | 19 may 2026 | In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system. |
| CVE-2026-8602 | Alta (8.8) | 0.58% | — | 19 may 2026 | In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings. |
| CVE-2025-70973 | Media (4.8) | 0.21% | — | 9 mar 2026 | ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. As a result,… |
| CVE-2021-26829 | Media (5.4) | 48% | ⚠ Explotación activa | 11 jun 2021 | OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. |
| CVE-2021-26828 | Alta (8.8) | 39% | ⚠ Explotación activa | 11 jun 2021 | OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. |
| CVE-2019-16344 | Media (6.1) | 1.0% | — | 14 oct 2019 | A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter. |
| CVE-2019-16321 | Media (6.1) | 0.82% | — | 15 sept 2019 | ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.