CVE-2023-45795: Pilz: XSS vulnerability in Pilz PASvisu and PMI v8xx

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-22 · updated 2026-09-26
Weakness: CWE-79

Description

A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.

Affected products

Pilz PASvisu: before 1.14.1 — fixed in 1.14.1
Pilz PMI v8xx: through 2.0.33992

How to fix

Upgrade to a fixed version: Pilz PASvisu 1.14.1. Check the vendor advisory for mitigations.

References

https://certvde.com/en/advisories/VDE-2023-050/

Get alerted when CVE-2023-45795 or the next vulnerability affects your stack