Threat Intelligence Database

CVE-2025-27380 is a high-severity cross-site scripting (XSS) vulnerability in Altium Enterprise Server (AES) version 7.0.3. It allows an authenticated attacker to inject malicious HTML/JavaScript into the Project Release feature, which executes in the context of other users' browsers. Exploitation requires user interaction and authentication but can lead to high confidentiality impact by stealing session tokens or sensitive data. The vulnerability affects all platforms running AES 7.0.3 and has a CVSS score of 7.6. No known public exploits exist yet, but the vulnerability's scope and impact warrant prompt mitigation.

HighVulnerabilityGermanyFranceItaly+3#cve#cve-2025-27380#cwe-79

CVE-2025-27379 is a stored cross-site scripting (XSS) vulnerability in Altium AES version 7.0.3, specifically in the BOM Viewer component. An authenticated attacker can inject arbitrary JavaScript code into the Description field of a schematic, which executes when the BOM Viewer renders the content. This vulnerability requires user interaction and authentication but can lead to high availability impact and limited confidentiality and integrity impact. The CVSS score is 6.8, indicating a medium severity. No known exploits are currently reported in the wild. European organizations using Altium AES 7.0.

MediumVulnerabilityGermanyFranceItaly+5#cve#cve-2025-27379#cwe-79

CVE-2025-27378 is a high-severity SQL injection vulnerability in Altium AES version 7.0.3 caused by an inactive configuration that disables the latest SQL parsing logic. This flaw allows unauthenticated remote attackers to inject and execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires no user interaction and can be exploited over the network, making it highly accessible. Although no known exploits are currently reported in the wild, the ease of exploitation and impact severity warrant immediate attention. European organizations using Altium AES 7.0.3, especially in critical infrastructure or manufacturing sectors, are at risk. Mitigation involves enabling the correct configuration to activate the updated SQL parsing logic or applying vendor patches once available.

HighVulnerabilityGermanyFranceItaly+2#cve#cve-2025-27378#cwe-89

The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges, exploitation results in privilege escalation to SYSTEM level. This vulnerability arises from an unquoted service path affecting systems where the executable resides in a path containing spaces. Affected products and versions include: ABP 2.0.7.6130 and earlier as well as AES 1.0.6.6133 and earlier.

CriticalVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2025-8070#cwe-428