CVE-2025-2745CWE-79

AVEVA PI Web API Cross-site Scripting

Medium · published June 12, 2025

CVSS v4.0
4.5
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023

SP1 and prior that, if exploited, could allow an authenticated attacker

(with privileges to create/update annotations or upload media files) to

persist arbitrary JavaScript code that will be executed by users who

were socially engineered to disable content security policy protections

while rendering annotation attachments from within a web browser.

The record
Technical detail
CVSS v4.0
4.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS
0.00248 · 15.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-06-12T19:42Z
EPSS history
Timeline
  • 12 JUN 19:42Z
    AVEVA PI Web API Cross-site Scripting
    cvelistv5