Cross-Site Scripting Vulnerability in AVEVA Application Server

CVE-2025-8386

What is CVE-2025-8386?

This security flaw in AVEVA Application Server allows an authenticated user with specific privileges to manipulate help files associated with App Objects. If successfully exploited, the vulnerability can lead to cross-site scripting (XSS), enabling an attacker to execute malicious scripts in a victim's browser. The risk of exploitation is particularly high during configuration operations within the Integrated Development Environment (IDE) component; however, the runtime components remain unaffected. The consequences can include unauthorized privilege escalation for the attacker, as the malicious scripts can execute actions on behalf of the victim.

References