Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-2745

AVEVA PI Web API Cross-site Scripting

Medium4.5EPSS 0.25%
Published
Updated
Reserved
Assigned by
icscert

Description

A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered to disable content security policy protections while rendering annotation attachments from within a web browser.

Timeline

  1. ID reserved

    By icscert

  2. · 3 months later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-2745, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)4.0Medium4.5CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N
icscertCNA (assigner)3.1Medium6.5CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
NVDNVD · Deferred4.0Medium4.5CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.25% · top 84% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.5.

Weakness

Affected products

What to do

Solution: AVEVA recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Users of affected product versions should apply security updates to mitigate the risk of exploit. From OSISoft Customer Portal https://my.osisoft.com/ , search for "PI Web API" and select version 2023 SP1 Patch 1 or higher.  For additional information please refer to AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .

Workaround: AVEVA further recommends users follow general defensive measures: * Review and update the file extensions allowlist https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1022248.html * for annotation attachments to remove potentially vulnerable of undesired file types (ex: svg, pdf, ...). * Consider implementing IT policies that would prevent users from subverting/disabling content security policy browser protections. * Inform PI Web API users that annotation attachments should be retrieved through direct REST requests to PI Web API rather than rendering them in the browser interface. * Audit assigned privileges to ensure that only trusted users are given "Annotate" access rights https://docs.aveva.com/bundle/pi-server-f-af-pse/page/1020021.html For additional information please refer to AVEVA-2025-003 https://www.aveva.com/en/support-and-success/cyber-security-updates/ .

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-2745 badge
[![CVE-2025-2745](https://trackcve.app/badge/CVE-2025-2745.svg)](https://trackcve.app/cve/CVE-2025-2745)

Record last updated .