CVE-2025-10551: Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

Medium severity · published Mar 31, 2026

CVE-2025-10551

Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

5.4

CVSS

0.2%

EPSS

On KEV

Description

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 6% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

ENOVIA Collaborative Industry Innovator · Dassault Systèmes

Release 3DEXPERIENCE R2023x Golden through Release 3DEXPERIENCE R2023x.FP.CFA.2541; Release 3DEXPERIENCE R2024x Golden through Release 3DEXPERIENCE R2024x.FP.CFA.2537; Release 3DEXPERIENCE R2025x Golden through Release 3DEXPERIENCE R2025x.FP.CFA.2514 · source: vendor

3dexperience · 3ds

r2023x through r2025x · source: NVD

Affected product

ENOVIA Collaborative Industry Innovator

Dassault Systèmes

All ENOVIA Collaborative Industry Innovator CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-10551

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-10551

Vendor Advisory

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10551

More from ENOVIA Collaborative Industry Innovator

5.4

CVE-2025-12956

Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

5.4

CVE-2025-10557

Stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x

5.4

CVE-2024-8004

Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x