CVE-2025-0827: Stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

High severity · published Mar 17, 2025

CVE-2025-0827

Stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

8.7

CVSS

0.3%

EPSS

On KEV

Description

A stored Cross-site Scripting (XSS) vulnerability affecting 3DPlay in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

High

Integrity

High

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 26% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

3DSwymer · Dassault Systèmes

Release 3DEXPERIENCE R2022x Golden through Release 3DEXPERIENCE R2022x.FP.CFA.2433; Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x.FP.CFA.2428; Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2432 · source: vendor

Affected product

3DSwymer

Dassault Systèmes

All 3DSwymer CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-0827

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-0827

www.3ds.com

https://www.3ds.com/vulnerability/advisories