This vulnerability (CVE-2025-10551) is a stored Cross-site Scripting (CWE-79) issue in the Document Management feature of ENOVIA Collaborative Industry Innovator versions from 3DEXPERIENCE R2023x Golden through R2025x Golden. An attacker can inject malicious script code that is stored and later executed in the context of another user's browser session, potentially compromising sensitive data and session integrity. The CVSS v3.1 base score is 8.7, reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity. The vulnerability is published and assigned by Dassault Systèmes but no patch or official remediation guidance is currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of authenticated users' browsers, leading to potential disclosure of sensitive information and unauthorized actions within the application. The impact affects confidentiality and integrity but does not impact system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting user privileges and educating users about the risks of interacting with untrusted content. Monitor Dassault Systèmes advisories for updates on patches or official mitigations.