cve-2021-31630

This script automatically exploits vulnerability in OpenPLC Web Server v3 You will be able to create an automatic Rever Shell with the server without having to use manual techniques. CVE-2021-31630 Detail Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code...

CVE-2021-31630-OpenPLC_RCE

CVE-2021-31630-OpenPLCRCE Exploit for Authenticated Remote Code Execution on OpenPLC v3 Webserver...

OpenPLC_v3

OpenPLC Runtime version 3 ⚠️ This project has reached End of Life and is no longer maintained. It has been replaced by OpenPLC Runtime v4. Please visit the new repository for installation instructions, documentation, and support. OpenPLC is an open-source Programmable Logic Controller that is base...

OpenPLC_v3

OpenPLC Runtime version 3 Introduction OpenPLC is an open-source programmable logic controller based on easy-to-use software. Our focus is to provide a low-cost industrial solution for automation and research. OpenPLC has been used in many research papers as a framework for industrial cybersecuri...

cve-2021-31630

cve-2021-31630 OpenPLC WebServer v3 - 認証済みRCE このPoCスクリプトは、Fellipe Oliveira が提供するエクスプロイトに基づいています。 特徴 : st ファイルアップロードの代わりに、Cコードを /hardware に直接アップロード リバースシェルをアップロードする前にデフォルトプログラムを復元 非ブロッキング な改良版Cベースのリバースシェルにより、Webサーバーがハングしません ; バックグラウンドでシェルを起動し、PLC停止後も exit するまで動作します クリーンアップ $ python cve202131630.py...

cve-2021-31630

cve-2021-31630 OpenPLC WebServer v3 - Authenticated RCE This PoC script is based on the exploit provided by Fellipe Oliveira. Features : Directly uploads C code to /hardware instead of st file upload Restores default program before uploading reverse shell Improved C based reverse shell which is n...

CVE-2021-31630

CVE-2021-31630 CVE encountered while hacking HTB machines; the exploit-db exploit had some errors, so here are manual exploitation methods and an exploit. Script Usage Command execution with no output python exp.py -u http://127.0.0.1:8080 -l openplc -p openplc -c "whoami" Manual Exploit The atta...

CVE-2026-31156

CVE-2026-31156 There is a path injection vulnerability in OpenPLC-v3, which arises from the program not performing any validity checks on the file path parameters passed in from the command line. Attackers can read any readable file by constructing malicious paths, posing a risk of information...

CVE-2021-31630

OpenPLC WebServer v3 - Authenticated RCE CVE-2021-31630 This exploit is based on the exploit from Exploit-DB made by Fellipe Oliveira. First, authenticate Upload a malicious C file Compile it Start the PLC initiate reverse shell Stop the PLC no need to run it, the reverse shell is already initiat...

htb-wifinetictwo-exploit

CVE-2021-31630 Exploit PoC This Python script is a Proof of Concept PoC exploit for CVE-2021-31630, targeting a vulnerability in OpenPLC running on the WifineticTwo box at HackTheBox. It is designed for educational purposes only, aiming to demonstrate the exploitation process in a controlled...

OpenPLC-CVE-2021-31630-RCE

OpenPLC v3 Authenticated RCE CVE-2021-31630 This is a modern Python 3.13+ compatible proof-of-concept exploit for CVE-2021-31630, a vulnerability in OpenPLC v3 that allows an authenticated user to upload a custom hardware layer containing malicious code, leading to remote code execution RCE on th...

CVE-2025-54962

🔥 CVE-2025-54962 — Insecure File Upload in OpenPLC Runtime Webserver OpenPLC Runtime ≤ 2024-12-31 — Stored XSS, CSRF 📌 Summary I discovered a vulnerability in the OpenPLC Runtime webserver released version: 2024-12-31 that allows authenticated users to upload arbitrary files e.g., .html, .svg as...

CVE-2025-41656

CVE-2025-41656 Project Summary This project exists to model CVE-2025-41656 , an unauthenticated remote code execution vulnerability for NodeRED. To model this vulnerability, we created a small form factor SCADA system with a raspberry pi, an actuator, and a sensor. The raspberry pi contains a...

CVE-2021-31630-HTB

CVE-2021-31630 Exploit CVE-2021-31630 Exploit PoC for OpenPLC on WifineticTwo box Hack The Box, This script serves as a Proof of Concept PoC exploit for CVE-2021-31630, targeting the OpenPLC service running on the WifineticTwo box on the Hack The Box platform. Usage python exploit.py -ip -p -u -p...

CVE-2025-34226

CVE-2025-34226: Persistent DoS in OpenPLC Runtime Vulnerability Overview Field| Value ---|--- CVE ID| CVE-2025-34226 Affects| OpenPLC Runtime V3 Fixed in| commit 095ee09623dd229b64ad3a1db38a901a3772f6fc Severity| High CVSS 4.0| CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N 7.1...

CVE-2021-31630-OpenPLC-3-Authenticated-RCE

CVE-2021-31630 OpenPLC 3 WebServer Authenticated Remote Code Execution. Description The presence of Command Injection in Open PLC Webserver v3 enables remote attackers to run arbitrary code by exploiting the "Hardware Layer Code Box" component found on the "/hardware" page of the application. Onl...

CVE-2026-88020

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-88020

Autonomy Logic OpenPLC Runtime v3 is susceptible to an improper neutralization of input during web page generation vulnerability. This occurs because the web interface fails to encode a query string parameter used for program routing. Successful exploitation could allow an attacker to hijack sess...

EUVD-2026-84871

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-88020 Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...