EUVD-2026-73928
GHSA-9hrx-9m98-rh8r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reflected XSS requires user interaction (UI:R) and changes scope to the victim browser (S:C); confidentiality and integrity set to Low as baseline without confirmed ICS-specific escalation path.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.
AnalysisAI
Cross-site scripting in AVEVA PIMBoards (Pipeline Integrity Monitor ≤ 2025 SP1 P1, build 7.1.9580.8513) enables unauthenticated remote attackers to execute arbitrary JavaScript in a targeted user's active browser session by tricking the user into clicking a crafted malicious link. The attack is classified CWE-79 (reflected XSS), requires active user interaction, and is reported by ICS-CERT - indicating relevance to operational technology and industrial pipeline environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Active user interaction is required - a PIMBoards user must be socially engineered into clicking a specially crafted malicious link; the vulnerability cannot be exploited without this step, making mass automated exploitation infeasible per SSVC automatable rating of no. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.3 appropriately reflects the mandatory active user interaction (UI:A), which structurally prevents automated or worm-style exploitation and narrows the attacker population to those capable of executing a targeted phishing or social engineering campaign. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the update referenced in AVEVA Security Bulletin AVEVA-2026-006, available at https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/SecurityBulletin_AVEVA-2026-006.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today