CVE-2025-10555CWE-79cross-site-scripting

CVE-2025-10555

High · published November 24, 2025

CVSS v3.1
8.7
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

⚡ An attacker can sneak arbitrary script code right into your browser session! This stored XSS vulnerability in DELMIA Service Process Engineer could spell trouble for your security. 🔥 Think of it like finding a hidden menu item at a restaurant that lets you order whatever you want without the chef checking the ingredients first. This vulnerability allows malicious scripts to run, just like an unauthorized dish could wreak havoc at dinnertime. If exploited, this flaw could let attackers hijack user sessions, steal sensitive information, or even manipulate user actions on the platform. It's like someone slipping into your account and doing everything behind the scenes, without you ever knowing!

Put simply

Think of it like finding a hidden menu item at a restaurant that lets you order whatever you want without the chef checking the ingredients first. This vulnerability allows malicious scripts to run, just like an unauthorized dish could wreak havoc at dinnertime. This stored Cross-site Scripting (XSS) vulnerability allows attackers to inject malicious scripts that are executed in the user's browser session when interacting with the Service Items Management feature of DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x.

What to do

If exploited, this flaw could let attackers hijack user sessions, steal sensitive information, or even manipulate user actions on the platform. It's like someone slipping into your account and doing everything behind the scenes, without you ever knowing! To safeguard against this vulnerability, update to the latest version of DELMIA Service Process Engineer as soon as possible. Implement strict input validation and output encoding to prevent script injections. Regularly review your security practices for the platform. You've got this! With a few tweaks, your system can be secure and ready to thwart any attacks. 🛡️

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-24T21:15Z
References (1)
EPSS history
Timeline
  • 24 NOV 15:31Z
    Stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x
    cvelistv5