Skip to content
OpenAdvisories

Vendor

AVEVA

55 known vulnerabilities.

Products

Process Optimization 7 Edge 7 AVEVA System Platform 6 PI Server 4 InTouch 4 Pipeline Integrity Monitor 4 Application Server 4 Historian 3 Communication Drivers Pack 3 Batch Management 3 PI Data Archive 2 PI Connector for CygNet 2 PI Web API 2 SystemPlatform 2 Enterprise Licensing (formerly known as License Manager) 2 Manufacturing Execution System (formerly known as Wonderware MES) 2 Recipe Management 2 Edge (formerly known as Indusoft Web Studio) 2 Worktasks (formerly known as Workflow Management) 2 Plant SCADA (formerly known as Citect) 2 Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds) 2 Telemetry Server 2 PI Integrator 2 Wonderware System Platform 1 AVEVA Edge 1 InTouch Access Anywhere 1 Reports for Operations 1 Vijeo Citect and Citect SCADA 1 AVEVA Plant SCADA 1 AVEVA Telemetry Server 1 SuiteLink Server 1 PI Asset Framework Client 1 PI Data Archive PI Server 1 Pipeline Simulation 2025 1 Platform Common Services (PCS) Portal 1 AVEVA Enterprise SCADA 1 AVEVA Enterprise SCADA HMI 1 AVEVA Pipeline Operations for Gas/Liquids 1 AVEVA Pipeline Integrity Monitor (delivered on Pipeline Simulation media) 1 PI to CONNECT Agent 1
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-81823

    AVEVA Pipeline Integrity Monitor Missing Authorization

    The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.

    AVEVA Pipeline Integrity Monitor
  • Medium 4.7
    CVE-2026-81824

    AVEVA Pipeline Integrity Monitor cross-site scripting

    The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.

    AVEVA Pipeline Integrity Monitor
  • Medium 6.5
    CVE-2026-1495

    Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent

    The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy credentials, from the PI to CONNECT event log files. This could enable unauthorized access to the proxy s…

    AVEVA PI to CONNECT Agent
  • Medium 6.9
    CVE-2025-8386

    AVEVA Application Server IDE Basic Cross-site Scripting

    The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal…

    AVEVA Application Server
  • Medium 6.5
    CVE-2025-41415

    AVEVA PI Integrator Insertion of Sensitive Information into Sent Data

    The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensitive information that could then be used to gain additional access to downstream resources.

    AVEVA PI Integrator
  • Medium 6.5
    CVE-2025-36539

    AVEVA PI Data Archive Uncaught Exception

    AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service.

    AVEVA PI Server PI Data Archive
  • Medium 6.5
    CVE-2025-2745

    AVEVA PI Web API Cross-site Scripting

    A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that…

    AVEVA PI Web API
  • Medium 4.4
    CVE-2025-4418

    AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value

    An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files (cache and …

    AVEVA PI Connector for CygNet
  • Medium 5.5
    CVE-2025-4417

    AVEVA PI Connector for CygNet Cross-site Scripting

    A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be…

    AVEVA PI Connector for CygNet
  • Medium 5.3
    CVE-2023-31274

    Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server

    AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive eve…

    AVEVA PI Server
  • Medium 5.5
    CVE-2023-34982

    AVEVA Operations Control Logger External Control of File Name or Path

    This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.

    AVEVA InTouch Application Server Historian Browsers
  • Medium 5.5
    CVE-2022-36969 EPSS 14%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 20…

    AVEVA Edge Browsers
  • Medium 6.6
    CVE-2021-32942

    The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowV…

    AVEVA InTouch