This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2025-2745 | BDVDB-2026-282298 Detail

AVEVAPI Web API

Description#

A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact low, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.