A stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
References
| Link | Resource |
|---|---|
| https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10556 | Vendor Advisory |
Configurations
History
21 Oct 2025, 19:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
3ds 3dexperience Enovia
3ds |
|
| CPE | cpe:2.3:a:3ds:3dexperience_enovia:*:*:*:*:*:*:*:* | |
| References | () https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10556 - Vendor Advisory |
13 Oct 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-13 08:15
Updated : 2025-10-21 19:57
NVD link : CVE-2025-10556
Mitre link : CVE-2025-10556
CVE.ORG link : CVE-2025-10556
JSON object : View
Products Affected
3ds
- 3dexperience_enovia
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')