GCVE - cpe:2.3:o:openplcproject:openplc_v3_firmware:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:o:openplcproject:openplc_v3_firmware:-:*:*:*:*:*:*:*

part: o version: - update: *

Vendor	Openplcproject (`65aa9aa3-a458-530b-911b-aa9e54bd32e6`)
Product	Openplc V3 Firmware (`062037af-7da7-517b-90e8-4f20fd9e3646`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/thiagoralves/openplc_v3`	purl2cpe	2026-06-01 10:11:41.473437

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-35556`	vulnerable	2026-06-08 07:59:14.131841	Plaintext storage of a password in OpenPLC_V3 OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information. Published: 2026-04-09T18:57:26.857Z Updated: 2026-04-10T18:03:50.288Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-35063`	vulnerable	2026-06-08 07:59:13.460196	Missing Authorization in OpenPLC_V3 OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with role=admin, escalating to full administrator access. Published: 2026-04-09T19:00:09.980Z Updated: 2026-04-10T18:04:45.721Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-28205`	vulnerable	2026-06-08 07:55:14.992512	Initialization of a resource with an insecure default in OpenPLC_V3 OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API. Published: 2026-04-09T18:54:58.694Z Updated: 2026-04-10T18:02:22.971Z Open on db.gcve.eu Reference links https://www.cisa.gov/news-events/ics-advisories/icsa-25-345-10	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37741`	vulnerable	2026-06-08 06:39:48.061599	Details available OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture. Published: 2024-06-28T00:00:00.000Z Updated: 2024-08-02T03:57:39.697Z Open on db.gcve.eu Reference links https://github.com/thiagoralves/OpenPLC_v3/issues/242 https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992 https://1d8.github.io/cves/cve_2024_37741/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-31630`	vulnerable	2026-06-08 05:31:53.789236	Details available Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" page of the application. Published: 2021-08-03T14:50:46.000Z Updated: 2024-08-03T23:03:33.671Z Open on db.gcve.eu Reference links https://www.youtube.com/watch?v=l08DHB08Gow https://packetstormsecurity.com/files/162563/OpenPLC-WebServer-3-Remote-Code-Execution.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-20818`	vulnerable	2026-06-08 05:11:28.105445	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.