CVE-2021-26828
HIGH KEVScadaBR < 0.9.1 - Authenticated Arbitrary JSP File Upload via view_edit.shtm
Title source: llmExploitation Summary
CVE-2021-26828 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added December 3, 2025. EIP tracks 4 public exploits from researchers including hev0x, ridpath, Yuri08loveElaina.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-26828, an authenticated arbitrary file upload vulnerability in ScadaBR. The exploit uploads a JSP webshell and triggers a reverse shell connection to an attacker-controlled host.
Description
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Exploits (4)
This repository contains a functional exploit for CVE-2021-26828, an authenticated arbitrary file upload vulnerability in ScadaBR. The exploit uploads a JSP webshell and triggers a reverse shell connection to an attacker-controlled host.
This repository contains a functional Python 3 exploit for CVE-2021-26828, targeting ScadaBR <1.1.0. It includes a JSP webshell upload mechanism via `view_edit.shtm` and supports reverse shell execution, enumeration, and cleanup features.
This repository contains a functional exploit for CVE-2021-26828, an authenticated arbitrary file upload vulnerability in ScadaBR. The exploit uploads a JSP webshell and triggers a reverse shell connection to an attacker-controlled host.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H