rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-10500 
Use after free in Dawn in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2025-09-24T16:17:12.209Z
CVE-2025-10501 
Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2025-09-24T16:17:12.775Z
CVE-2025-10502 
Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2025-09-24T16:17:13.365Z
CVE-2025-10503 Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding. This allows for the injection of malicious JavaScript payloads, enabling reflected cross-site scripting.

An attacker can leverage this vulnerability to redirect the user's browser to a malicious website, modify the user interface of the web page, retrieve information from the browser, or cause other harmful actions. However, due to the protection of session-related cookies with the httpOnly flag, session hijacking is not possible.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WSO2
product: WSO2 Identity Server
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: 2026-04-29T08:08:37.335Z
CVE-2025-10504 Heap Memory Corruption Vulnerability
Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: ABB
product: Terra AC wallbox
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: ABB acknowledges and thanks Ryo Kato for responsibly disclosing the vulnerabilities and providing valuable input on  product improvements.
Published: 2025-09-29T04:12:18.599Z
CVE-2025-10527 Sandbox escape due to use-after-free in the Graphics: Canvas2D component
Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Oskar L
Published: 2025-09-16T12:26:35.079Z
CVE-2025-10528 Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Oskar L
Published: 2025-09-16T12:26:35.394Z
CVE-2025-10529 Same-origin policy bypass in the Layout component
Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Daniel Holbert
Published: 2025-09-16T12:26:35.822Z
CVE-2025-10530 Spoofing issue in the WebAuthn component in Firefox for Android
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Hafiizh & Kang Ali
Published: 2025-09-16T12:26:37.795Z
CVE-2025-10531 Mitigation bypass in the Web Compatibility: Tooling component
Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Nikolaos Mourousias
Published: 2025-09-16T12:26:38.264Z
CVE-2025-10532 Incorrect boundary conditions in the JavaScript: GC component
Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Gary Kwong
Published: 2025-09-16T12:26:36.188Z
CVE-2025-10533 Integer overflow in the SVG component
Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andrew Creskey
Published: 2025-09-16T12:26:34.655Z
CVE-2025-10534 Spoofing issue in the Site Permissions component
Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Emma Zühlcke
Published: 2025-09-16T12:26:38.630Z
CVE-2025-10535 Information disclosure, mitigation bypass in the Privacy component in Firefox for Android
Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143.
Affected products: vendor: Mozilla
product: Firefox
Credits: lang: en
value: Rebeca Tudor
Published: 2025-09-16T12:26:38.955Z
CVE-2025-10536 Information disclosure in the Networking: Cache component
Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Ibuki Sato
Published: 2025-09-16T12:26:36.546Z
CVE-2025-10537 Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Credits: lang: en
value: Andrew McCreight and the Mozilla Fuzzing Team
Published: 2025-09-16T12:26:37.029Z
CVE-2025-10538 Authentication Bypass in LG Innotek Camera
An authentication bypass vulnerability exists in LG Innotek camera models LND7210 and LNV7210R. The vulnerability allows a malicious actor to gain access to camera information including user account information.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: LG Innotek
product: Camera Model LND7210
default_status: unaffected
vendor: LG Innotek
product: Camera Model LNV7210R
default_status: unaffected
Published: 2025-10-01T04:02:35.188Z
CVE-2025-10539 Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper certificate validation
cwe_id: CWE-296
description: CWE-296 Improper following of a certificate's chain of trust
cwe_id: CWE-494
description: CWE-494 Download of code without integrity check
Affected products: vendor: DeskTime
product: DeskTime Time Tracking App
default_status: unaffected
Credits: lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2026-04-28T07:52:23.279Z
CVE-2025-10540 Unencrypted and Unauthenticated Communication Allows Data Exposure and Manipulation in iMonitor EAM
iMonitor EAM 9.6394 transmits communication between the EAM client agent and the EAM server, as well as between the EAM monitor management software and the server, in plaintext without authentication or encryption. An attacker with network access can intercept sensitive information (such as credentials, keylogger data, and personally identifiable information) and tamper with traffic. This allows both unauthorized disclosure and modification of data, including issuing arbitrary commands to client agents.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: iMonitor Software Inc.
product: iMonitor EAM
default_status: unknown
Credits: lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
Published: 2025-09-25T14:05:05.646Z
CVE-2025-10541 Local Privilege Escalation via Insecure Update Mechanism in iMonitor EAM
iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\sysupdate\ directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application’s installation path and executed with SYSTEM privileges, leading to privilege escalation.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: iMonitor Software Inc.
product: iMonitor EAM
default_status: unknown
Credits: lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
Published: 2025-09-25T14:31:32.644Z
CVE-2025-10542 Insecure Default Admin Credentials Enable Full Administrative Access in iMonitor EAM
iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and data. This enables reading highly sensitive telemetry (including keylogger output) and issuing arbitrary actions to all connected clients.
Problem types: cwe_id: CWE-1392
description: CWE-1392 Use of Default Credentials
Affected products: vendor: iMonitor Software Inc.
product: iMonitor EAM
default_status: unknown
Credits: lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
Published: 2025-09-25T14:35:18.879Z
CVE-2025-10543 
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet).


The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).
Problem types: cwe_id: CWE-681
description: CWE-681 Incorrect Conversion between Numeric Types
cwe_id: CWE-197
description: CWE-197 Numeric Truncation Error
Affected products: vendor: Eclipse Foundation
product: paho.mqtt.golang (Go MQTT v3.1 library)
default_status: unaffected
Credits: lang: en
value: Paul Gerste
Published: 2025-12-02T08:18:16.724Z
CVE-2025-10544 Unrestricted uploading of dangerous file types to AvePoint products
Unrestricted file upload vulnerability in DocAve 6.13.2, Perimeter 1.12.3, Compliance Guardian 4.7.1, and earlier versions, allowing administrator users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files that compromise the system. In addition, it is vulnerable to Path Traversal, which allows files to be written to arbitrary directories within the web root.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: AvePoint
product: DocAve
default_status: unaffected
vendor: AvePoint
product: Perimeter
default_status: unaffected
vendor: AvePoint
product: Compliance Guardian
default_status: unaffected
Credits: lang: en
value: Chetani Mesa Guzmán
lang: en
value: Marcos Díaz Castiñeiras
Published: 2025-09-26T09:51:12.104Z
CVE-2025-10545 Guest user can add unauthorized team users to private channels
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: LOW
baseScore: 3.1
Credits: lang: en
value: lordwillmore
Published: 2025-10-16T08:24:25.928Z
CVE-2025-10546 Cross-Site Scripting (XSS) Vulnerability in PPC XPON ONT Wi-Fi Router
This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal. A remote attacker could exploit this vulnerability by injecting malicious JavaScript into the vulnerable parameter, leading to a reflected Cross-Site Scripting (XSS) attack on the targeted system.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: PPC Technologies
product: PPC XPON ONT (Optical Network Terminal) 2K15X
default_status: unaffected
Credits: lang: en
value: This vulnerability is reported by Shravan Singh & Amey Chavekar
Published: 2025-09-16T12:18:58.822Z
CVE-2025-10547 CVE-2025-10547
An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.
Problem types: description: CWE-456: Missing Initialization of a Variable
Affected products: vendor: DrayTek Corporation
product: Vigor1000B
vendor: DrayTek Corporation
product: Vigor2962
vendor: DrayTek Corporation
product: Vigor3910
vendor: DrayTek Corporation
product: Vigor3912
vendor: DrayTek Corporation
product: Vigor2135
vendor: DrayTek Corporation
product: Vigor2763
vendor: DrayTek Corporation
product: Vigor2765
vendor: DrayTek Corporation
product: Vigor2766
vendor: DrayTek Corporation
product: Vigor2865
vendor: DrayTek Corporation
product: Vigor2865 LTE Series
vendor: DrayTek Corporation
product: Vigor2865L-5G Series
vendor: DrayTek Corporation
product: Vigor2866
vendor: DrayTek Corporation
product: Vigor2866 LTE
vendor: DrayTek Corporation
product: Vigor2927
vendor: DrayTek Corporation
product: Vigor 2927 LTE
vendor: DrayTek Corporation
product: Vigor2927L-5G
vendor: DrayTek Corporation
product: Vigor2915
vendor: DrayTek Corporation
product: Vigor2862
vendor: DrayTek Corporation
product: Vigor2862 LTE
vendor: DrayTek Corporation
product: Vigor2926
Published: 2025-10-03T11:35:43.752Z
CVE-2025-10548 Missing Certificate Validation in CleverControl Installer Allows Remote Code Execution
The CleverControl employee monitoring software (v11.5.1041.6) fails to validate TLS server certificates during the installation process. The installer downloads and executes external components using curl.exe --insecure, enabling a man-in-the-middle attacker to deliver malicious files that are executed with SYSTEM privileges. This can lead to full remote code execution with administrative rights. No patch is available as the vendor has been unresponsive. It is assumed that previous versions are also affected, but this is not confirmed.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: CleverControl
product: CleverControl employee monitoring software
default_status: unknown
Credits: lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2025-09-23T06:49:33.659Z
CVE-2025-10549 DLL Hijacking in EfficientLab Controlio Leads to Local Privilege Escalation
EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in this directory and achieve arbitrary code execution with highest privileges, because the affected service runs as NT AUTHORITY\SYSTEM.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: EfficientLab, LLC
product: Controlio
default_status: unaffected
Credits: lang: en
value: Tobias Niemann, SEC Consult Vulnerability Lab
lang: en
value: Daniel Hirschberger, SEC Consult Vulnerability Lab
lang: en
value: Thorger Jansen, SEC Consult Vulnerability Lab
lang: en
value: Marius Renner, SEC Consult Vulnerability Lab
Published: 2026-04-23T06:57:27.220Z
CVE-2025-10551 Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x
A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: ENOVIA Collaborative Industry Innovator
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
baseScore: 8.7
baseSeverity: HIGH
Published: 2026-03-31T08:38:33.576Z
CVE-2025-10552 Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: 3DSwymer
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Published: 2025-10-13T07:36:11.959Z
CVE-2025-10553 Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x
A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: DELMIA Factory Resource Manager
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
baseScore: 8.7
baseSeverity: HIGH
Published: 2026-03-31T08:41:35.663Z
CVE-2025-10554 Stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x
A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Dassault Systèmes
product: ENOVIA Product Manager
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 8.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Published: 2025-11-24T15:31:39.739Z