CVE-2025-12956

EPSS 0.04%
Veröffentlicht 08.12.2025 08:38:45
Zuletzt bearbeitet 12.01.2026 18:49:43
Quelle 3DS.Information-Security@3ds.c
CVE-Watchlists
Login
Unerledigt
Login

A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

3ds ≫ 3dexperience Enovia Version >= r2022x <= r2025x

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.04%	0.109

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
3DS.Information-Security@3ds.com	8.7	2.3	5.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.3ds.com/trust-center/security/security-advisories/cve-2025-12956

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-12956

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-12956

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-12956

EUVD