CVE-2025-4417
AVEVA PI Connector for CygNet Cross-site Scripting
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jun 12, 2025
- Updated
- Jun 12, 2025
- Reserved
- May 7, 2025
Description
A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit affected pages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N | icscert |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N | icscert |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
PI Connector for CygNetAVEVA |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.