Loading vulnerability details…
CVSS v3.1
5.5
CVSS v4.0
6.9
EPSS
0.13%
Published
Jun 12, 2025
Modified
Apr 14, 2026
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit affected pages.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:NWeaknesses (CWE)
References (2)