AVEVA Application Server vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting AVEVA Application Server: 1 record(s), with affected versions and fixes.
CVE-2025-8386
Medium · 6.9
CWE-80 Nov 14, 2025
AVEVA Application Server IDE Basic Cross-site Scripting
The vulnerability, if exploited, could allow an authenticated miscreant
(with privilege of "aaConfigTools") to tamper with App Objects' help
files and persist a cross-site scripting (XSS) injection that when
executed by a victim user, can result in horizontal or vertical
escalation of privileges. The vulnerability can only be exploited during
config-time operations within the IDE component of Application Server.
Run-time components and operations are not affected.