CVE-2025-54962

🔥 CVE-2025-54962 — Carga de archivos insegura en el servidor web de OpenPLC Runtime OpenPLC Runtime ≤ 2024-12-31 — XSS almacenado, CSRF 📌 Resumen Descubrí una vulnerabilidad en el servidor web de OpenPLC Runtime versión publicada: 2024-12-31 que permite a los usuarios autenticados subir archivos...

CVE-2025-34226

CVE-2025-34226：OpenPLC 运行时中的持久化拒绝服务 漏洞概述 字段| 值 ---|--- CVE ID| CVE-2025-34226 影响| OpenPLC 运行时 V3 修复版本| 提交 095ee09623dd229b64ad3a1db38a901a3772f6fc 严重程度| 高 CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N 7.1（高） CWE| CWE-664 资源生命周期控制不当，CWE-20 输入验证不恰当 概要 OpenPLC 运行时在...

OpenPLC_v3

OpenPLC Runtime 版本 3 ⚠️ 本项目已到达生命周期终点（End of Life），不再维护。 它已被 OpenPLC Runtime v4 取代。 请访问新仓库获取安装说明、文档和支持。 OpenPLC 是一个基于易用软件的开源可编程逻辑控制器。我们专注于为自动化和研究提供低成本的工业解决方案。由于 OpenPLC 是唯一提供完整源代码的控制器，它已被许多研究论文用作工业网络安全研究的框架。 OpenPLC 项目由两个子项目组成： 1. Runtime 2. 编程编辑器 安装： root@kitploit: git clone...

OpenPLC_v3

OpenPLC Runtime version 3 简介 OpenPLC 是一个基于软件、易于使用的开源可编程逻辑控制器。我们的重点是为自动化与研究提供低成本的工业解决方案。OpenPLC 已被多篇研究论文用作工业网络安全研究的框架，因为它是唯一提供完整源代码的控制器。OpenPLC 项目包含三个子项目： 1. Runtime 2. 编程编辑器 3. HMI 构建器 安装 root@kitploit: mkdir /opt/PLC cd /opt/PLC git clone https://github.com/tranquac/OpenPLCv3.git cd OpenPLCv3...

CVE-2026-71268

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-71268

OpenPLC Runtime v3 is affected by a path traversal in compile_program() (webserver/openplc.py): it processes directives of the form (FILE:path content ) and writes to os.path.join('./core', file_path) without validating that file_path stays under ./core. A crafted ST file like (FILE:../../../etc/...

CVE-2026-71268

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-71268 OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

OpenPLC Runtime version 3 安全漏洞

OpenPLC Runtime version 3 is a programmable logic controller developed by Thiago Alves. There is a security vulnerability in OpenPLC Runtime version 3. This vulnerability stems from the REST API endpoints only checking the existence of JWTs without verifying the caller’s role. This could allow...

OpenPLC Runtime version 3 安全漏洞

OpenPLC Runtime version 3 is a programmable logic controller developed by Thiago Alves. There is a security vulnerability in OpenPLC Runtime version 3, which stems from the use of unsafe default values during resource initialization. This vulnerability could allow attackers to access the system...

OpenPLC Runtime version 3 跨站请求伪造漏洞

OpenPLC Runtime version 3 is a programmable logic controller by the individual developer Thiago Alves. OpenPLC Runtime version 3 suffers from a cross-site request forgery vulnerability that stems from a lack of CSRF authentication, which could lead to a cross-site request forgery attack...

EUVD-2021-26682

Malware in sbrugna...

EUVD-2024-38109

Malicious code in bioql PyPI...

EUVD-2024-38110

Malicious code in bioql PyPI...

EUVD-2024-36331

Malicious code in bioql PyPI...

CVE-2025-34226

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epochtime field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate...

CVE-2025-34226 OpenPLC Runtime v3 Persistent DoS

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epochtime field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate...

CVE-2025-34226

OpenPLC Runtime v3 is affected by an input validation flaw in the /upload-program-action endpoint: the epoch_time parameter submitted during program uploads is not validated, allowing corruption of the programs database. After a malformed upload, the runtime can operate, but on restart the databa...

OpenPLC Runtime version 3 安全漏洞

OpenPLC Runtime version 3 is a programmable logic controller by Thiago Alves Individual Developer. A security vulnerability exists in OpenPLC Runtime version 3, which stems from insufficient input validation of the epochtime field, which could lead to program database corruption, resulting in a...