A stored cross-site scripting flaw exists in the Runtime component of Pilz PASvisu prior to version 1.14.1 and in Pilz PMI v8xx up to and including version 2.0.33992. An attacker can inject malicious scripts that are subsequently executed within a victim’s browser whenever the affected data is displayed, enabling the attacker to manipulate process data. This can lead to unauthorized changes in process parameters and potentially disrupt normal operations.

The vulnerability affects Pilz PASvisu versions earlier than 1.14.1 and Pilz PMI v8xx up to and including 2.0.33992. Higher‑level versions are not impacted.

The CVSS score of 8.1 indicates high severity. Exploitation is possible over the network from a low‑privileged or unauthenticated attacker, which is inferred from the description of a stored XSS that can be triggered remotely. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through unauthorized web‑based interactions, but this is not explicitly stated in the advisory and is therefore inferred.