Skip to content
OpenAdvisories
Medium ICSA-25-317-02 1 CVE

AVEVA Application Server IDE

Published Nov 13, 2025 · Updated Nov 13, 2025

Vendor: AVEVA Product: Application Server

Summary

Successful exploitation of this vulnerability could allow an attacker to tamper with help files and inject cross-site scripting (XSS) code.

Vulnerabilities 1

  • Medium 6.9
    CVE-2025-8386

    AVEVA Application Server IDE Basic Cross-site Scripting

    The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal…

    AVEVA Application Server

Revision history

  1. #1

    Initial Publication

References