CVE-2023-45795— Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-45795
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx
Source: NVD (National Vulnerability Database)
Vulnerability Description
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Pilz PASvisu 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pilz pasvisu是德国Pilz公司的一款人机界面可视化软件。 Pilz PASvisu和PMI v8xx存在跨站脚本漏洞，该漏洞源于Builder Component组件问题，可能导致本地未经验证攻击者注入恶意JavaScript脚本并获得设备完全控制权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-45795
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-45795
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-45795 (1)
IV. Related Vulnerabilities
Same vendor: Pilz
- CVE-2023-45796
XSS vulnerability in Pilz PASvisu and PMI v8xx - CVE-2025-41648
Pilz: Authentication Bypass in IndustrialPI Webstatus - CVE-2025-41656
Pilz: Missing Authentication in Node-RED integration - CVE-2022-40977
PILZ: PASvisu and PMI affected by ZipSlip - CVE-2022-40976
PILZ: Multiple products affected by ZipSlip
Same weakness: CWE-79
- CVE-2026-5922
Poly Voice – Potential Unauthorized Modification of WebUI us - CVE-2026-55877
Symfony UX: XSS in symfony/ux-icons via unsanitized SVG cont - CVE-2026-54527
JupyterLab Git: Stored XSS leading to RCE - CVE-2026-58191
Appium: Reflected XSS / arbitrary JS in @appium/base-driver - CVE-2026-6896
Improper Neutralization of Input During Web Page Generation
V. Comments for CVE-2023-45795
No comments yet