CVE-2025-10551 is a high-severity stored Cross-site Scripting (XSS) vulnerability in the Document Management component of Dassault Systèmes ENOVIA Collaborative Industry Innovator. It affects versions from Release 3DEXPERIENCE R2023x Golden through R2025x Golden. This vulnerability allows an attacker with limited privileges and requiring user interaction to execute arbitrary script code within the browser session of other users. The vulnerability impacts confidentiality and integrity but does not affect availability. No official patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-3476 is a high-severity code injection vulnerability in Dassault Systèmes SOLIDWORKS Desktop versions Release 2025 SP0 and Release 2026 SP0. An attacker can exploit this flaw by convincing a user to open a specially crafted file, leading to arbitrary code execution on the victim's machine. The vulnerability requires local access (attack vector: local) and user interaction (opening the file), but no privileges or authentication are needed. Successful exploitation impacts confidentiality, integrity, and availability severely. No known exploits are currently in the wild, and no patches have been released yet. Organizations using affected SOLIDWORKS versions should exercise caution when handling files from untrusted sources and prepare to apply vendor patches once available.
A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session.
An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
An Out-Of-Bounds Read vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
A Use of Uninitialized Variable vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to execute arbitrary code while opening a specially crafted EPRT file.
A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
CVE-2025-10555 is a high-severity stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes DELMIA Service Process Engineer, specifically in the Service Items Management component of Release 3DEXPERIENCE R2025x Golden. This vulnerability allows an attacker with limited privileges and requiring user interaction to inject malicious scripts that execute in the context of other users' browsers, potentially leading to theft of sensitive information and session hijacking. Although no known exploits are currently reported in the wild, the vulnerability's high CVSS score (8.7) indicates significant risk. European organizations using this software, especially in manufacturing and industrial sectors, could face confidentiality and integrity breaches. Mitigation involves applying vendor patches once available, implementing strict input validation and output encoding, and restricting user privileges. Countries with strong manufacturing bases and Dassault Systèmes customer presence, such as France, Germany, Italy, and the UK, are most likely to be affected. Defenders should prioritize monitoring for suspicious script injections and educate users about phishing attempts leveraging this vulnerability.
A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
A stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x could allow an attacker to execute arbitrary code on the user's machine.
A Use of Uninitialized Variable vulnerability affecting the JT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted JT file.
A Use After Free vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted PAR file.
An Out-Of-Bounds Read vulnerability affecting the PAR file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 could allow an attacker to execute arbitrary code while opening a specially crafted PAR file.
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.
