CVE-2025-4417CWE-79

AVEVA PI Connector for CygNet Cross-site Scripting

Medium · published June 12, 2025

CVSS v4.0

6.9

EPSS

Percentile

3.8

In the wild

Unconfirmed

What it is

A cross-site scripting vulnerability exists in

AVEVA PI Connector for CygNet

Versions 1.6.14 and prior that, if exploited, could allow an

administrator miscreant with local access to the connector admin portal

to persist arbitrary JavaScript code that will be executed by other

users who visit affected pages.

The record

Technical detail

CVSS v4.0: 6.9 · MEDIUM
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS: 0.00149 · 3.8th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-06-12T19:32Z

EPSS history

Timeline