{"metadata": {"vulnerability": "cve-2021-26828", "count": 52, "kinds": {"milestone": 4, "sighting": 23, "kev": 11, "other": 14}}, "data": [{"timestamp": "2021-02-05T00:00:00Z", "date_only": false, "value": "2021-02-05T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2021-26828", "field": "cveMetadata.dateReserved"}, {"timestamp": "2021-05-14T01:56:05Z", "date_only": false, "value": "2021-05-14T01:56:05.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pwnwiki_zhchannel/422", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "62e03b9e-ca88-4ab7-a84d-927e8451ce48", "content": "CVE-2021-26828 ScadaBR 1.0 / 1.1CE Windows Shell \u4e0a\u50b3\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-26828_ScadaBR_1.0_/_1.1CE_Windows_Shell_%E4%B8%8A%E5%82%B3%E6%BC%8F%E6%B4%9E", "url": "https://t.me/pwnwiki_zhchannel/422"}, {"timestamp": "2021-06-11T11:10:58Z", "date_only": false, "value": "2021-06-11T11:10:58.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2021-26828", "field": "cveMetadata.datePublished"}, {"timestamp": "2021-06-11T11:10:58Z", "date_only": false, "value": "2021-06-11T11:10:58.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2021-26828", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2021-06-11T12:15:00Z", "date_only": false, "value": "2021-06-11T12:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J87G-5G8X-JJXC", "record": "GHSA-J87G-5G8X-JJXC", "field": "database_specific.nvd_published_at"}, {"timestamp": "2021-06-11T12:15:00Z", "date_only": false, "value": "2021-06-11T12:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2021-26828", "record": "GSD-2021-26828", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2021-06-11T12:15:12.017Z", "date_only": false, "value": "2021-06-11T12:15:12.017", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26828", "record": "FKIE_CVE-2021-26828", "field": "published"}, {"timestamp": "2021-06-21T18:47:00Z", "date_only": false, "value": "2021-06-21T18:47Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2021-26828", "record": "GSD-2021-26828", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-05-24T19:05:12Z", "date_only": false, "value": "2022-05-24T19:05:12Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J87G-5G8X-JJXC", "record": "GHSA-J87G-5G8X-JJXC", "field": "published"}, {"timestamp": "2022-07-04T22:17:17Z", "date_only": false, "value": "2022-07-04T22:17:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/3610", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "055e112f-3222-4ad7-9171-2605831ce7eb", "content": "#exploit\n1. CVE-2021-31950:\nMicrosoft SharePoint Server 16.0.10372.20060 - SSRF\nhttps://packetstormsecurity.com/files/163080/mssharepoint16-ssrf.txt\n// MS SharePoint Server suffers from a GetXmlDataFromDataSource SSRF vulnerability\n\n2. CVE-2021-26828:\nOpenPLC ScadaBR <0.9.1 on Linux and <1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm\nhttps://github.com/hevox/CVE-2021-26828_ScadaBR_RCE", "url": "https://t.me/CyberSecurityTechnologies/3610"}, {"timestamp": "2023-12-12T01:23:48Z", "date_only": false, "value": "2023-12-12T01:23:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/1785", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "8df2eb9c-baa2-4d95-a5e9-04e371e7e904", "content": "#ExploitObserverAlert\n\nCVE-2021-26828\n\nDESCRIPTION: Exploit Observer has 9 entries related to CVE-2021-26828. OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.\n\nFIRST-EPSS: 0.008750000\nNVD-IS: 5.9\nNVD-ES: 2.8", "url": "https://t.me/arpsyndicate/1785"}, {"timestamp": "2023-12-13T01:23:33.541Z", "date_only": false, "value": "2023-12-13T01:23:33.541555Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2021-26828", "record": "GSD-2021-26828", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-03T20:33:41.301Z", "date_only": false, "value": "2024-08-03T20:33:41.301Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2021-26828", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-01-06T17:43:55Z", "date_only": false, "value": "2025-01-06T17:43:55.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/9737", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "1d1024ee-bbc4-490a-81f3-202987d32915", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1apython3 port of https://github.com/hev0x/CVE-2021-26828_ScadaBR_RCE/blob/main/LinScada_RCE.py\nURL\uff1ahttps://github.com/voidvxvt/CVE-2021-26828\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/9737"}, {"timestamp": "2025-01-06T18:43:12Z", "date_only": false, "value": "2025-01-06T18:43:12.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://gist.github.com/voidvxvt/719c34da30a644b822765729be648985", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "337f3a99-cae5-4d34-8fc2-1bdc94ab6f91", "url": "https://gist.github.com/voidvxvt/719c34da30a644b822765729be648985"}, {"timestamp": "2025-05-30T01:02:10Z", "date_only": false, "value": "2025-05-30T01:02:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/38604", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "dcb6345d-8ad4-4dde-9546-6a28fde921f2", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aScadaFlare Authenticated RCE Exploit Framework for ScadaBR (CVE-2021-26828) OpenPLC ScadaBR \nURL\uff1ahttps://github.com/ridpath/CVE-2021-26828-Ultimate\n\n\u6807\u7b7e\uff1a#RCE", "url": "https://t.me/GithubRedTeam/38604"}, {"timestamp": "2025-10-24T08:13:32.266Z", "date_only": false, "value": "2025-10-24T08:13:32.266227Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-f5921064-b7bcd332ac747253", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "bf79e91d-9031-4e61-98f8-4a44fb01fad9", "url": "https://poliverso.org/objects/0477a01e-f5921064-b7bcd332ac747253"}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": false, "value": "2025-12-03T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2021-26828", "field": "timestamps.asserted_at", "uuid": "ae37338a-756c-4d70-bfe0-b51ffec31af7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": true, "value": "2025-12-03", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-26828", "field": "containers.adp.1.metrics.2.other.content.dateAdded"}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": true, "value": "2025-12-03", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2021-26828", "field": "evidence.0.details.date_added", "uuid": "ae37338a-756c-4d70-bfe0-b51ffec31af7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": false, "value": "2025-12-03T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2021-26828", "field": "timestamps.first_seen_at", "uuid": "ae37338a-756c-4d70-bfe0-b51ffec31af7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": false, "value": "2025-12-03T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-26828", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": false, "value": "2025-12-03T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26828", "record": "FKIE_CVE-2021-26828", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": false, "value": "2025-12-03T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2021-26828", "field": "status.status_updated_at", "uuid": "ae37338a-756c-4d70-bfe0-b51ffec31af7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-12-03T00:00:00Z", "date_only": false, "value": "2025-12-03T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-26828", "field": "containers.adp.1.timeline.0.time"}, {"timestamp": "2025-12-03T20:01:24.369Z", "date_only": false, "value": "2025-12-03T20:01:24.369595Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pigondrugs.bsky.social/post/3m74aqnqhc32u", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "8a2a3910-dbc2-48c0-bde1-59067ee56a26", "url": "https://bsky.app/profile/pigondrugs.bsky.social/post/3m74aqnqhc32u"}, {"timestamp": "2025-12-03T20:36:46.894Z", "date_only": false, "value": "2025-12-03T20:36:46.894950Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/users/hrbrmstr/statuses/115657552999997488", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "2419deb0-6689-4165-a4fc-6308246c4393", "url": "https://mastodon.social/users/hrbrmstr/statuses/115657552999997488"}, {"timestamp": "2025-12-03T20:38:05.184Z", "date_only": false, "value": "2025-12-03T20:38:05.184195Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hrbrmstr.mastodon.social.ap.brid.gy/post/3m74cqypmexo2", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "6f3665f3-74b0-4ac3-b72d-ce0e2bcf2bf1", "url": "https://bsky.app/profile/hrbrmstr.mastodon.social.ap.brid.gy/post/3m74cqypmexo2"}, {"timestamp": "2025-12-03T21:30:58Z", "date_only": false, "value": "2025-12-03T21:30:58Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J87G-5G8X-JJXC", "record": "GHSA-J87G-5G8X-JJXC", "field": "modified"}, {"timestamp": "2025-12-04T04:55:19.651Z", "date_only": false, "value": "2025-12-04T04:55:19.651Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2021-26828", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-12-04T04:55:19.651Z", "date_only": false, "value": "2025-12-04T04:55:19.651Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2021-26828", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-12-04T18:21:37.855Z", "date_only": false, "value": "2025-12-04T18:21:37.855913Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/115662683959324733", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "899a5801-9431-4212-992f-0416a9d4d254", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/115662683959324733"}, {"timestamp": "2025-12-04T21:02:36.243Z", "date_only": false, "value": "2025-12-04T21:02:36.243744Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m76umtasfn2a", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "e07cd146-36a6-41a3-b2b8-f01b2eadf0a2", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m76umtasfn2a"}, {"timestamp": "2025-12-04T23:29:22.241Z", "date_only": false, "value": "2025-12-04T23:29:22.241699Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m774tfnsqs24", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "f7b2174d-6a69-4741-8c33-823fe64c6071", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m774tfnsqs24"}, {"timestamp": "2025-12-05T17:20:07.344Z", "date_only": false, "value": "2025-12-05T17:20:07.344799Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3m7ayo42ab62v", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "2d25e5cf-96f0-4ffb-a38d-51fc8dd24b7b", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3m7ayo42ab62v"}, {"timestamp": "2025-12-06T01:10:49.145Z", "date_only": false, "value": "2025-12-06T01:10:49.145526Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m7bsxqbjbc2p", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "038afc8e-3e13-4f8f-818d-920e48b99f22", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m7bsxqbjbc2p"}, {"timestamp": "2025-12-06T08:34:53.849Z", "date_only": false, "value": "2025-12-06T08:34:53.849381Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m7clrr3wxk27", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "79349111-7e67-45c2-ac72-96c1585b01b3", "url": "https://bsky.app/profile/getpokemon7.bsky.social/post/3m7clrr3wxk27"}, {"timestamp": "2025-12-24T00:00:00Z", "date_only": true, "value": "2025-12-24", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2021-26828", "field": "evidence.0.details.due_date", "uuid": "ae37338a-756c-4d70-bfe0-b51ffec31af7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-02-02T12:25:45.507Z", "date_only": false, "value": "2026-02-02T12:25:45.507317Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fc5b0752-b988-428c-8274-6bf35ca27519", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "0bf49bba-7ff8-49f8-a455-a2dc32ab43f6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fc5b0752-b988-428c-8274-6bf35ca27519"}, {"timestamp": "2026-02-02T12:25:45.507Z", "date_only": false, "value": "2026-02-02T12:25:45.507317Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fc5b0752-b988-428c-8274-6bf35ca27519", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "f9e41b72-f989-43c0-aec5-6de3727745f1", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fc5b0752-b988-428c-8274-6bf35ca27519"}, {"timestamp": "2026-02-02T13:24:01Z", "date_only": false, "value": "2026-02-02T13:24:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2021-26828", "field": "timestamps.recorded_at", "uuid": "ae37338a-756c-4d70-bfe0-b51ffec31af7", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-03-04T01:42:18.896Z", "date_only": false, "value": "2026-03-04T01:42:18.896212Z", "kind": "sighting", "label": "Seen", "source": "https://feedsin.space/feed/CISAKevBot/items/5922960", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "6375d7de-cb66-439c-9aca-8cd8b85b13e4", "url": "https://feedsin.space/feed/CISAKevBot/items/5922960"}, {"timestamp": "2026-05-25T05:43:17Z", "date_only": false, "value": "2026-05-25T05:43:17.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://dreamgroup.com/vulnerability-advisory-unauthenticated-remote-code-execution-in-scadabr-1-2-0", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "78716c1a-47dc-4e6e-b35a-7e816acd5486", "url": "https://dreamgroup.com/vulnerability-advisory-unauthenticated-remote-code-execution-in-scadabr-1-2-0"}, {"timestamp": "2026-06-01T10:45:29Z", "date_only": false, "value": "2026-06-01T10:45:29+00:00", "kind": "kev", "label": "Asserted", "source": "kevintel", "record": "CVE-2021-26828", "field": "timestamps.asserted_at", "uuid": "e98a4e98-1105-4fec-8461-0327ea86d121", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:45:29Z", "date_only": false, "value": "2026-06-01T10:45:29+00:00", "kind": "kev", "label": "First seen", "source": "kevintel", "record": "CVE-2021-26828", "field": "timestamps.first_seen_at", "uuid": "e98a4e98-1105-4fec-8461-0327ea86d121", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:45:29Z", "date_only": false, "value": "2026-06-01T10:45:29+00:00", "kind": "kev", "label": "Status updated", "source": "kevintel", "record": "CVE-2021-26828", "field": "status.status_updated_at", "uuid": "e98a4e98-1105-4fec-8461-0327ea86d121", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-01T10:45:29.301Z", "date_only": false, "value": "2026-06-01T10:45:29.301Z", "kind": "kev", "label": "Catalog added", "source": "kevintel", "record": "CVE-2021-26828", "field": "evidence.0.details.added_date", "uuid": "e98a4e98-1105-4fec-8461-0327ea86d121", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-17T03:43:49.877Z", "date_only": false, "value": "2026-06-17T03:43:49.877", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2021-26828", "record": "FKIE_CVE-2021-26828", "field": "lastModified"}, {"timestamp": "2026-06-19T12:41:46Z", "date_only": false, "value": "2026-06-19T12:41:46+00:00", "kind": "kev", "label": "Recorded", "source": "kevintel", "record": "CVE-2021-26828", "field": "timestamps.recorded_at", "uuid": "e98a4e98-1105-4fec-8461-0327ea86d121", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-06-19T12:42:11.787Z", "date_only": false, "value": "2026-06-19T12:42:11.787001Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/e98a4e98-1105-4fec-8461-0327ea86d121", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "d11cc15f-242b-4dd8-8021-10565e4c73fc", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/e98a4e98-1105-4fec-8461-0327ea86d121"}, {"timestamp": "2026-06-19T12:45:21.698Z", "date_only": false, "value": "2026-06-19T12:45:21.698784Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1edb7a58-7fd9-4f73-9e3a-213cbc738159", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "0a63e639-fe56-4172-8a80-8a4cbd3614e5", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1edb7a58-7fd9-4f73-9e3a-213cbc738159"}, {"timestamp": "2026-06-23T14:03:47.291Z", "date_only": false, "value": "2026-06-23T14:03:47.291207Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e6e524d5-3cca-4180-b2a7-9d2b31e6255a", "record": "CVE-2021-26828", "field": "creation_timestamp", "uuid": "fbb41acc-ce92-4b4d-b8b2-ca9e30cca9e7", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e6e524d5-3cca-4180-b2a7-9d2b31e6255a"}]}