Skip to content
OpenAdvisories

Vendor

arcinfo

14 known vulnerabilities.

Products

PcVue 14
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-14867

    Insecure password storage in User directory

    Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials.  Active Directory accounts are not affected by this vulnerability.

    arcinfo PcVue
  • Medium 5.3
    CVE-2026-1698

    HTTP Host header vulnerability in WebClient and WebScheduler web apps

    A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only aff…

    arcinfo PcVue
  • Medium 5.3
    CVE-2026-1697

    Use of unsecure cookies for GraphicalData web service and WebClient web app

    The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.

    arcinfo PcVue
  • Medium 5.3
    CVE-2026-1695

    XSS vulnerability upon unsuccessful authentication

    An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from anoth…

    arcinfo PcVue
  • Medium 5.3
    CVE-2026-1693

    Use of vulnerable Resource Owner Password Credentials flow

    The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow …

    arcinfo PcVue
  • Medium 5.3
    CVE-2026-1692

    Missing origin validation in GraphicalData web service requests

    A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a succe…

    arcinfo PcVue
  • Medium 6.0
    CVE-2025-9998 Public exploit

    Improper validation of packets sequencing

    The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulnerability to send specially crafted messages to force the application to stop.

    arcinfo PcVue
  • Medium 6.0
    CVE-2025-4384

    Certificate validity not properly verified

    The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the …

    arcinfo PcVue