CVE-2025-10554: 3dexperience enovia from r2023x (inclusive), through r2025x (inclusive); +1 more affected products

Affected technology

3dexperience enovia · from r2023x (inclusive), through r2025x (inclusive)
3ds

ENOVIA Product Manager · Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x FP.CFA.2505, Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x FP.CFA.2450, Release 3DEXPERIENCE R2025x Golden through Release 3DEXPERIENCE R2025x FP.CFA.2514
Dassault Systèmes

Description’s affected range: through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker can execute arbitrary script code in user's browser session. Vendor/CNA’s CVSS 3.1 assessment (base score 8.7/10) rates confidentiality and integrity impact as high; availability impact as none. NVD’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.