CVE-2025-4992 Stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting XSS vulnerability affecting Service Items Management in Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

CVE-2025-4992

CVE-2025-4992 is a stored XSS vulnerability in Service Items Management of Dassault Systèmes’ Service Process Engineer (3DEXPERIENCE R2024x through R2025x). The issue allows an attacker to execute arbitrary script code in an authenticated user’s browser session via the affected component/file, wi...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Mozilla Firefox ESR 128.11 MFSA 2025-44, bsc1243353: MFSA-TMP-2025-0001: Double-free in libvpx encoder bmo1962421 CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content bmo1960745...

CVE-2025-41406

Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specific operation, an arbitrary script may be executed on the web browser of the moderator user...

CVE-2025-41406

Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specific operation, an arbitrary script may be executed on the web browser of the moderator user...

Dassault Systèmes Project Portfolio Manager 跨站脚本漏洞

Dassault Systèmes Project Portfolio Manager is an application from Dassault Systèmes, France. It is responsible for developing and implementing the project portfolio management process. A cross-site scripting vulnerability exists in Dassault Systèmes Project Portfolio Manager 3DEXPERIENCE R2022x...

PT-2025-23261 · Wivia 5 · Wivia 5

Name of the Vulnerable Software and Affected Versions: Wivia 5 affected versions not specified Description: A cross-site scripting issue exists. If exploited, when a user connects to the affected device with a specific operation, an arbitrary script may be executed on the web browser of the...

Dassault Systèmes Collaborative Industry Innovator 跨站脚本漏洞

Dassault Systèmes Collaborative Industry Innovator is a software for collaborative management from Dassault Systèmes France. A cross-site scripting vulnerability exists in Dassault Systèmes Collaborative Industry Innovator versions 3DEXPERIENCE R2023x through 3DEXPERIENCE R2025x, which stems from...

Dassault Systèmes Collaborative Industry Innovator 跨站脚本漏洞

Dassault Systèmes Collaborative Industry Innovator is a software for collaborative management from Dassault Systèmes France. A cross-site scripting vulnerability exists in Dassault Systèmes Collaborative Industry Innovator versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x, which originates...

CVE-2025-4984: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

Dassault Systèmes Product Manager 跨站脚本漏洞

Dassault Systèmes Product Manager is a product management software from Dassault Systèmes France. A cross-site scripting vulnerability exists in Dassault Systèmes Product Manager versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x, which originates from stored cross-site scripting and could...

Dassault Systèmes Product Manager 跨站脚本漏洞

Dassault Systèmes Product Manager is a product management software from Dassault Systèmes France. A cross-site scripting vulnerability exists in Dassault Systèmes Product Manager versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x, which originates from stored cross-site scripting and could...

CVE-2025-4985: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability affecting Risk Management in Project Portfolio Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

Uchida Yoko wivia 跨站脚本漏洞

The Uchida Yoko wivia is a presentation aid from Uchida Yoko Japan that wirelessly projects a computer screen to a display device such as a projector. A cross-site scripting vulnerability exists in Uchida Yoko wivia that originates from cross-site scripting and could lead to the execution of...

CVE-2025-0602: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

CVE-2025-41406: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability exists in wivia 5 all versions. If exploited, when a user connects to the affected device with a specific operation, an arbitrary script may be executed on the web browser of the moderator user...

CVE-2025-4983: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability affecting City Referential in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Error handling for script execution is incorrectly isolated from web content, which could allow cross-origin leak attacks...

WordPress plugin Smash Balloon Social Photo Feed 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Smash Balloon Social Photo Feed plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping...

Medium: yelp-xsl

Issue Overview: A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. CVE-2025-3155 Affected Packages: yelp-xsl...