Aveva Pi Web API vulnerabilities

2 CVEs affecting Aveva Pi Web API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-2745, published 2025-06-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-3468, published 2024-06-12. High severity, CVSS 8.4. EPSS: 0.4% chance of exploitation in the next 30 days. There is a vulnerability in AVEVA PI Web API that could allow malicious code to execute on the PI Web API environment under the privileges of an interactive user that was socially engineered to use…
CVE-2025-2745, published 2025-06-12. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or…