Vendors / ScadaBR Records 11 All Threatist records
Exploited (KEV) 2
CVSS critical 1
CVSS high 4
Exploited now ScadaBR records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority CRITICAL 97KEV
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.39096 · Published 2021-06-11 · No fix listed CWE-434
Priority HIGH 82KEV
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.4805 · Published 2021-06-11 · No fix listed CWE-79
Priority MEDIUM 44
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
CVSS 4.0 HIGH 8.6· Network · No auth · User interaction · EPSS 0.00178 · Published 2026-05-19 · No fix listed CWE-352
Priority MEDIUM 44
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
CVSS 4.0 HIGH 8.8· Network · No auth · No interaction · EPSS 0.00448 · Published 2026-05-19 · No fix listed CWE-306
Priority MEDIUM 43
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server.
CVSS 3.1 CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00411 · Published 2026-05-28 · No fix listed CWE-78
Priority MEDIUM 42
In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.
CVSS 4.0 HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.01317 · Published 2026-05-19 · No fix listed CWE-78
Priority LOW 29
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
CVSS 4.0 MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00387 · Published 2026-05-19 · No fix listed CWE-798
Priority LOW 29
A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01036 · Published 2019-10-14 · No fix listed CWE-79
Priority LOW 29
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00818 · Published 2019-09-15 · No fix listed CWE-79
Priority LOW 26
A reflected cross-site scripting issue exists in URL handling.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00158 · Published 2026-05-28 · No fix listed CWE-80
Priority LOW 22
ScadaBR 1.12.4 is vulnerable to Session Fixation.
CVSS 3.1 MEDIUM 4.8· Network · No auth · No interaction · EPSS 0.00233 · Published 2026-03-09 · No fix listed CWE-384
Open these records in search → All records by CVSS severity
1 4 6 0 0
THREATIST.IORead the docs