CVE-2025-34226

CVE-2025-34226: OpenPLC Runtimeにおける持続的DoS 脆弱性概要...

CVE-2025-54962

🔥 CVE-2025-54962 — Unsicherer Datei-Upload im OpenPLC Runtime Webserver OpenPLC Runtime ≤ 2024-12-31 — Stored XSS, CSRF 📌 Zusammenfassung Ich habe eine Schwachstelle im OpenPLC Runtime Webserver Release-Version: 2024-12-31 entdeckt, die es authentifizierten Benutzern ermöglicht, beliebige Dateien...

OpenPLC_v3

OpenPLC Runtime version 3 Introduzione OpenPLC è un controllore logico programmabile open source basato su un software facile da usare. Il nostro obiettivo è fornire una soluzione industriale a basso costo per l'automazione e la ricerca. OpenPLC è stato utilizzato in numerosi articoli di ricerca...

OpenPLC_v3

OpenPLC Runtime Version 3 ⚠️ Dieses Projekt hat das Ende seiner Lebensdauer erreicht und wird nicht mehr gewartet. Es wurde durch OpenPLC Runtime v4 ersetzt. Bitte besuchen Sie das neue Repository für Installationsanweisungen, Dokumentation und Support. OpenPLC ist eine...

CVE-2026-71268

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-71268

OpenPLC Runtime v3 is affected by a path traversal in compile_program() (webserver/openplc.py): it processes directives of the form (FILE:path content ) and writes to os.path.join('./core', file_path) without validating that file_path stays under ./core. A crafted ST file like (FILE:../../../etc/...

CVE-2026-71268

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-71268 OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

OpenPLC Runtime version 3 安全漏洞

OpenPLC Runtime version 3 is a programmable logic controller developed by Thiago Alves. There is a security vulnerability in OpenPLC Runtime version 3, which stems from the use of unsafe default values during resource initialization. This vulnerability could allow attackers to access the system...

OpenPLC Runtime version 3 安全漏洞

OpenPLC Runtime version 3 is a programmable logic controller developed by Thiago Alves. There is a security vulnerability in OpenPLC Runtime version 3. This vulnerability stems from the REST API endpoints only checking the existence of JWTs without verifying the caller’s role. This could allow...

OpenPLC Runtime version 3 跨站请求伪造漏洞

OpenPLC Runtime version 3 is a programmable logic controller by the individual developer Thiago Alves. OpenPLC Runtime version 3 suffers from a cross-site request forgery vulnerability that stems from a lack of CSRF authentication, which could lead to a cross-site request forgery attack...

EUVD-2021-26682

Malware in sbrugna...

EUVD-2024-38109

Malicious code in bioql PyPI...

EUVD-2024-36331

Malicious code in bioql PyPI...

EUVD-2024-38110

Malicious code in bioql PyPI...

CVE-2025-34226

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epochtime field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate...

CVE-2025-34226 OpenPLC Runtime v3 Persistent DoS

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epochtime field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate...

CVE-2025-34226

OpenPLC Runtime v3 is affected by an input validation flaw in the /upload-program-action endpoint: the epoch_time parameter submitted during program uploads is not validated, allowing corruption of the programs database. After a malformed upload, the runtime can operate, but on restart the databa...

PT-2025-40533

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description The software contains an input validation flaw in the /upload-program-action API endpoint. The epoch time parameter, when submitting program uploads, is not validated, potentially leading to corruption of...