Pilz vulnerabilities
We track 5 vulnerabilities in Pilz products across 14 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on June 22, 2026.
Latest Pilz vulnerabilities
- 8.1 High severity
PMI v8xx: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthenticated attacker to manipulate process data with potential impact on integrity
- 7.8 High severity
PMI v8xx: Improper Neutralization of Input During Web Page Generation
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full control over the device.
- 10.0 Critical severity
IndustrialPI 4 with Firmware Bullseye: Missing Authentication for Critical Functionality
An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.
- 9.8 Critical severity
IndustrialPI 4 with IndustrialPI webstatus: Incorrect Type Conversion or Cast
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.
- 7.5 High severity
PASvisu: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or