CVE-2025-10551
Published: 31 March 2026
Summary
CVE-2025-10551 is a high-severity Cross-site Scripting (CWE-79) vulnerability in 3Ds 3Dexperience. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-10551 is a Stored Cross-site Scripting (XSS) vulnerability, classified under CWE-79, in the Document Management component of ENOVIA Collaborative Industry Innovator. It affects releases from 3DEXPERIENCE R2023x through 3DEXPERIENCE R2025x. The flaw enables an attacker to inject and store malicious script code that executes in the browser session of users viewing affected documents, with a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to network accessibility, low complexity, and significant impacts on confidentiality and integrity across a changed scope.
An attacker with low privileges (PR:L) can exploit this over the network (AV:N) with low attack complexity (AC:L), but it requires user interaction (UI:R), such as a victim accessing a maliciously crafted document. Successful exploitation allows execution of arbitrary JavaScript in the victim's browser context, potentially leading to high confidentiality and integrity impacts (C:H/I:H), such as session hijacking, data theft, or further compromise within the application's scope (S:C), though availability remains unaffected (A:N).
The vendor has published a security advisory at https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10551, which security practitioners should consult for details on patches, workarounds, and mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209132
Vulnerability details
A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS directly enables exploitation of a web application (T1190) and arbitrary JavaScript execution in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires identifying, reporting, and correcting system flaws like this stored XSS vulnerability, directly enabling application of the vendor's patch to eliminate the root cause.
SI-10 mandates validation of information inputs to the Document Management component, preventing injection and storage of malicious scripts.
SI-15 requires filtering of information outputs prior to execution, blocking execution of stored malicious scripts in users' browser sessions when viewing documents.