Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-54962. PoCs published by Eyodav.
AI-analyzed exploit summary This repository provides a detailed proof-of-concept for CVE-2025-54962, demonstrating an insecure file upload vulnerability in OpenPLC Runtime Webserver (≤ 2024-12-31). The exploit allows authenticated users to upload arbitrary files (e.g., HTML, SVG) as profile pictures, leading to stored XSS and unauthenticated access to malicious content.
Description
/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then publicly accessible under the /static URI.
Exploits (1)
This repository provides a detailed proof-of-concept for CVE-2025-54962, demonstrating an insecure file upload vulnerability in OpenPLC Runtime Webserver (≤ 2024-12-31). The exploit allows authenticated users to upload arbitrary files (e.g., HTML, SVG) as profile pictures, leading to stored XSS and unauthenticated access to malicious content.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N