ScadaBR vulnerabilities
We track 5 vulnerabilities in ScadaBR products. 4 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on May 28, 2026.
Latest ScadaBR vulnerabilities
- 9.9 Critical severity
ScadaBR: Improper Neutralization of Special Elements used in an OS Command
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.
- 8.8 High severity
ScadaBR: Cross-Site Request Forgery
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
- 9.1 Critical severity
ScadaBR: Missing Authentication for Critical Functionality
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
- 5.4 Medium severity
OpenPLC ScadaBR Cross-site Scripting Exploited
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
- 8.8 High severity
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Exploited
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.