Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-0832

Summary
Assigner-3DS
Assigner Org ID-f5a594e6-46a7-4e60-8a08-0a786e70e433
Published At-17 Mar, 2025 | 13:50
Updated At-17 Mar, 2025 | 14:07
Rejected At-
Credits

Stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:3DS
Assigner Org ID:f5a594e6-46a7-4e60-8a08-0a786e70e433
Published At:17 Mar, 2025 | 13:50
Updated At:17 Mar, 2025 | 14:07
Rejected At:
▼CVE Numbering Authority (CNA)
Stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Affected Products
Vendor
Dassault Systèmes S.E. (3DS)Dassault Systèmes
Product
ENOVIA Collaborative Industry Innovator
Default Status
unaffected
Versions
Affected
  • From Release 3DEXPERIENCE R2022x Golden through Release 3DEXPERIENCE R2022x.FP.CFA.2424 (custom)
  • From Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x.FP.CFA.2428 (custom)
  • From Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2432 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-79CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Type: CWE
CWE ID: CWE-79
Description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Metrics
VersionBase scoreBase severityVector
3.18.7HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Version: 3.1
Base score: 8.7
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.3ds.com/vulnerability/advisories
N/A
Hyperlink: https://www.3ds.com/vulnerability/advisories
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:3DS.Information-Security@3ds.com
Published At:17 Mar, 2025 | 14:15
Updated At:17 Mar, 2025 | 14:15

A stored Cross-site Scripting (XSS) vulnerability affecting Project Gantt in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.7HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Type: Secondary
Version: 3.1
Base score: 8.7
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-79Secondary3DS.Information-Security@3ds.com
CWE ID: CWE-79
Type: Secondary
Source: 3DS.Information-Security@3ds.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.3ds.com/vulnerability/advisories3DS.Information-Security@3ds.com
N/A
Hyperlink: https://www.3ds.com/vulnerability/advisories
Source: 3DS.Information-Security@3ds.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

141Records found
CVE-2024-12090
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.06% / 17.16%
||
7 Day CHG~0.00%
Published-16 Dec, 2024 | 15:06
Updated-16 Dec, 2024 | 16:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-12091
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.06% / 17.16%
||
7 Day CHG~0.00%
Published-16 Dec, 2024 | 15:06
Updated-16 Dec, 2024 | 16:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-12092
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.06% / 17.16%
||
7 Day CHG~0.00%
Published-16 Dec, 2024 | 15:07
Updated-16 Dec, 2024 | 16:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-12089
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.06% / 17.16%
||
7 Day CHG~0.00%
Published-16 Dec, 2024 | 15:06
Updated-16 Dec, 2024 | 16:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4983
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:19
Updated-30 May, 2025 | 21:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-City Referential Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4988
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:19
Updated-30 May, 2025 | 21:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Results Analytics in Multidisciplinary Optimization Engineer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Multidisciplinary Optimization Engineer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4984
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:19
Updated-30 May, 2025 | 21:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-City Referential Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4989
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:19
Updated-30 May, 2025 | 22:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Product Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4987
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG+0.01%
Published-16 Jun, 2025 | 07:22
Updated-16 Jun, 2025 | 17:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Project Portfolio Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4991
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:16
Updated-30 May, 2025 | 22:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4986
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:19
Updated-30 May, 2025 | 21:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Product Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4990
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:16
Updated-30 May, 2025 | 22:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Change Governance in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Product Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4985
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:19
Updated-30 May, 2025 | 21:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Project Portfolio Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-4992
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:15
Updated-30 May, 2025 | 22:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Service Process Engineer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0596
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:47
Updated-17 Mar, 2025 | 16:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0828
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:50
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Engineering Release in ENOVIA Product Engineering Specialist from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Product Engineering Specialist
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0601
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:49
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0598
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:48
Updated-17 Mar, 2025 | 16:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0600
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:49
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0827
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:49
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3DSwymer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0602
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.04% / 12.49%
||
7 Day CHG~0.00%
Published-30 May, 2025 | 14:19
Updated-30 May, 2025 | 21:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0829
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:50
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3D Markup in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0826
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:49
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3D Navigate in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0595
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:47
Updated-17 Mar, 2025 | 16:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3DSwymer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-7737
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.10% / 27.78%
||
7 Day CHG~0.00%
Published-19 Sep, 2024 | 15:19
Updated-20 Sep, 2024 | 12:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3DSwymer3dswymer_3dexperience_20233dswymer_3dexperience_20223dswymer_3dexperience_2024
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-7736
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.10% / 27.78%
||
7 Day CHG~0.00%
Published-19 Sep, 2024 | 15:18
Updated-20 Sep, 2024 | 12:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator3dexperience_enovia
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-7932
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.24% / 46.85%
||
7 Day CHG~0.00%
Published-02 Sep, 2024 | 11:48
Updated-13 Sep, 2024 | 07:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dexperience3DSwymer3dswymer_3dexperience_2024
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-6380
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.10% / 27.78%
||
7 Day CHG~0.00%
Published-16 Oct, 2024 | 11:28
Updated-16 Oct, 2024 | 16:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovatorenovia_collaborative_industry_innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-6378
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.79% / 72.95%
||
7 Day CHG~0.00%
Published-20 Aug, 2024 | 13:45
Updated-21 Aug, 2024 | 15:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dexperienceENOVIA Collaborative Industry Innovatorcollaborative_industry_innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0833
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:50
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0599
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:49
Updated-17 Mar, 2025 | 14:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Collaborative Industry Innovator
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0830
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.03% / 7.83%
||
7 Day CHG+0.01%
Published-17 Mar, 2025 | 13:50
Updated-17 Mar, 2025 | 14:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting Meeting Management in ENOVIA Change Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-ENOVIA Change Manager
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-8004
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.24% / 46.85%
||
7 Day CHG~0.00%
Published-02 Sep, 2024 | 11:49
Updated-04 Sep, 2024 | 14:56
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dexperience_enoviaENOVIA Collaborative Industry Innovator3dswymer_3dexperience_20233dswymer_3dexperience_20223dswymer_3dexperience_2024
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-7939
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.24% / 46.85%
||
7 Day CHG~0.00%
Published-02 Sep, 2024 | 11:49
Updated-13 Sep, 2024 | 07:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dexperience3DSwymer3dswymer_3dexperience_2024
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-7938
Matching Score-10
Assigner-Dassault Systèmes
ShareView Details
Matching Score-10
Assigner-Dassault Systèmes
CVSS Score-8.7||HIGH
EPSS-0.24% / 46.85%
||
7 Day CHG~0.00%
Published-02 Sep, 2024 | 11:48
Updated-04 Sep, 2024 | 14:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dexperience3DSwymer3dswymer_3dexperience_20233dswymer_3dexperience_2024
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-2139
Matching Score-6
Assigner-Dassault Systèmes
ShareView Details
Matching Score-6
Assigner-Dassault Systèmes
CVSS Score-5.4||MEDIUM
EPSS-0.30% / 52.56%
||
7 Day CHG~0.00%
Published-21 Apr, 2023 | 15:44
Updated-04 Feb, 2025 | 20:27
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022

A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-delmia_aprisoDELMIA Apriso
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-1996
Matching Score-6
Assigner-Dassault Systèmes
ShareView Details
Matching Score-6
Assigner-Dassault Systèmes
CVSS Score-6.1||MEDIUM
EPSS-0.37% / 57.94%
||
7 Day CHG~0.00%
Published-19 May, 2023 | 16:37
Updated-12 Feb, 2025 | 16:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Reflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x

A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dexperience3DEXPERIENCE
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-5599
Matching Score-6
Assigner-Dassault Systèmes
ShareView Details
Matching Score-6
Assigner-Dassault Systèmes
CVSS Score-5.4||MEDIUM
EPSS-0.47% / 63.63%
||
7 Day CHG~0.00%
Published-21 Nov, 2023 | 09:28
Updated-07 Aug, 2024 | 20:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dswymer_3dexperience_20223dswymer_3dexperience_20233DSwymer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-5598
Matching Score-6
Assigner-Dassault Systèmes
ShareView Details
Matching Score-6
Assigner-Dassault Systèmes
CVSS Score-5.4||MEDIUM
EPSS-0.18% / 40.34%
||
7 Day CHG~0.00%
Published-21 Nov, 2023 | 09:29
Updated-02 Aug, 2024 | 08:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x

Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dswymer_3dexperience_20223dswymer_3dexperience_20233DSwymer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-5597
Matching Score-6
Assigner-Dassault Systèmes
ShareView Details
Matching Score-6
Assigner-Dassault Systèmes
CVSS Score-5.4||MEDIUM
EPSS-0.17% / 38.58%
||
7 Day CHG~0.00%
Published-17 May, 2024 | 16:54
Updated-02 Aug, 2024 | 08:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3DSwymer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-3588
Matching Score-6
Assigner-Dassault Systèmes
ShareView Details
Matching Score-6
Assigner-Dassault Systèmes
CVSS Score-5.4||MEDIUM
EPSS-0.11% / 30.24%
||
7 Day CHG~0.00%
Published-13 Sep, 2023 | 18:22
Updated-02 Aug, 2024 | 07:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x

A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-teamwork_cloud_no_magic_releaseTeamwork Cloud - Business Pro EditionTeamwork Cloud - Standard EditionTeamwork Cloud - Business EditionTeamwork Cloud - Enterprise Edition
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-6379
Matching Score-6
Assigner-Dassault Systèmes
ShareView Details
Matching Score-6
Assigner-Dassault Systèmes
CVSS Score-7.7||HIGH
EPSS-0.24% / 46.85%
||
7 Day CHG~0.00%
Published-20 Aug, 2024 | 13:44
Updated-27 Aug, 2024 | 09:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

Action-Not Available
Vendor-Dassault Systèmes S.E. (3DS)
Product-3dexperience3DSwymer3dswymer_3dexperience_20233dswymer_3dexperience_20223dswymer_3dexperience_2024
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-3594
Matching Score-4
Assigner-WPScan
ShareView Details
Matching Score-4
Assigner-WPScan
CVSS Score-8.7||HIGH
EPSS-0.96% / 75.50%
||
7 Day CHG~0.00%
Published-23 May, 2024 | 06:00
Updated-21 May, 2025 | 19:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
IDonate <= 1.9.0 - Admin+ Stored XSS

The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Action-Not Available
Vendor-themeatelierUnknown
Product-idonateIDonate
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-22241
Matching Score-4
Assigner-GitLab Inc.
ShareView Details
Matching Score-4
Assigner-GitLab Inc.
CVSS Score-8.7||HIGH
EPSS-0.18% / 40.41%
||
7 Day CHG~0.00%
Published-05 Aug, 2021 | 19:28
Updated-03 Aug, 2024 | 18:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name.

Action-Not Available
Vendor-GitLab Inc.
Product-gitlabGitLab
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-3482
Matching Score-4
Assigner-OpenText (formerly Micro Focus)
ShareView Details
Matching Score-4
Assigner-OpenText (formerly Micro Focus)
CVSS Score-8.7||HIGH
EPSS-0.19% / 40.60%
||
7 Day CHG~0.00%
Published-20 May, 2024 | 13:09
Updated-01 Aug, 2024 | 20:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OpenText ArcSight Enterprise Security Manager and ArcSight Platform Stored XSS

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Enterprise Security Manager and ArcSight Platform. The vulnerability could be remotely exploited.

Action-Not Available
Vendor-Open Text Corporation
Product-ArcSight Enterprise Security ManagerArcSight Platform
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-26222
Matching Score-4
Assigner-TIBCO Software Inc.
ShareView Details
Matching Score-4
Assigner-TIBCO Software Inc.
CVSS Score-8.7||HIGH
EPSS-0.41% / 60.60%
||
7 Day CHG~0.00%
Published-14 Nov, 2023 | 19:29
Updated-30 Aug, 2024 | 14:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
TIBCO EBX Cross-site Scripting (XXS) Vulnerability

The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.22 and below, versions 6.0.13 and below and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 5.0.0 and below.

Action-Not Available
Vendor-TIBCO (Cloud Software Group, Inc.)
Product-ebxTIBCO Product and Service Catalog powered by TIBCO EBXTIBCO EBX
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-2442
Matching Score-4
Assigner-GitLab Inc.
ShareView Details
Matching Score-4
Assigner-GitLab Inc.
CVSS Score-8.7||HIGH
EPSS-83.69% / 99.24%
||
7 Day CHG~0.00%
Published-07 Jun, 2023 | 00:00
Updated-07 Jan, 2025 | 17:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.

Action-Not Available
Vendor-GitLab Inc.
Product-gitlabGitLab
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-22932
Matching Score-4
Assigner-Splunk Inc.
ShareView Details
Matching Score-4
Assigner-Splunk Inc.
CVSS Score-8||HIGH
EPSS-0.56% / 67.35%
||
7 Day CHG~0.00%
Published-14 Feb, 2023 | 17:22
Updated-28 Feb, 2025 | 11:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Persistent Cross-Site Scripting through a Base64-encoded Image in a View in Splunk Enterprise

In Splunk Enterprise 9.0 versions before 9.0.4, a View allows for Cross-Site Scripting (XSS) through the error message in a Base64-encoded image. The vulnerability affects instances with Splunk Web enabled. It does not affect Splunk Enterprise versions below 9.0.

Action-Not Available
Vendor-Splunk LLC (Cisco Systems, Inc.)
Product-splunksplunk_cloud_platformSplunk Cloud PlatformSplunk Enterprise
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-16945
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-8.7||HIGH
EPSS-0.45% / 62.83%
||
7 Day CHG~0.00%
Published-16 Oct, 2020 | 22:18
Updated-04 Aug, 2024 | 13:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Microsoft Office SharePoint XSS Vulnerability

<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p>

Action-Not Available
Vendor-Microsoft Corporation
Product-sharepoint_serversharepoint_foundationsharepoint_enterprise_serverMicrosoft SharePoint Server 2019Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Foundation 2013 Service Pack 1
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-16944
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-8.7||HIGH
EPSS-0.58% / 68.03%
||
7 Day CHG~0.00%
Published-16 Oct, 2020 | 22:17
Updated-04 Aug, 2024 | 13:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Microsoft SharePoint Reflective XSS Vulnerability

<p>This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.</p> <p>An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who successfully exploited this vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the victim, such as change permissions, delete content, steal sensitive information (such as browser cookies) and inject malicious content in the browser of the victim.</p> <p>For this vulnerability to be exploited, a user must click a specially crafted URL that takes the user to a targeted SharePoint Web App site.</p> <p>In an email attack scenario, an attacker could exploit the vulnerability by sending an email message containing the specially crafted URL to the user of the targeted SharePoint Web App site and convincing the user to click the specially crafted URL.</p> <p>In a web-based attack scenario, an attacker would have to host a website that contains a specially crafted URL to the targeted SharePoint Web App site that is used to attempt to exploit these vulnerabilities. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. An attacker would have no way to force users to visit a specially crafted website. Instead, an attacker would have to convince them to visit the website, typically by getting them to click a link in an instant messenger or email message that takes them to the attacker's website, and then convince them to click the specially crafted URL.</p> <p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes user web requests.</p>

Action-Not Available
Vendor-Microsoft Corporation
Product-sharepoint_serversharepoint_foundationsharepoint_enterprise_serverMicrosoft SharePoint Server 2019Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Foundation 2013 Service Pack 1
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • Previous
  • 1
  • 2
  • 3
  • Next
Details not found