Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

3DSwym in 3DEXPERIENCE R2025x: Malicious scripts can run in user's browser

CVE-2025-10552 · published 1 year ago
Summary

A security issue in 3DSwym, part of 3DEXPERIENCE R2025x, allows an attacker to inject malicious code into a user's browser session, potentially leading to unauthorized actions or data theft. This affects users who interact with 3DSwym on the affected system. To protect yourself, ensure you're running the latest version of 3DEXPERIENCE R2025x and consider implementing additional security measures to prevent such attacks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
3ds 3dswymer r2025x
cpe:2.3:a:3ds:3dswymer:r2025x:*:*:*:*:*:*:*
Original advisory text
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Oct 2025
Updated2 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-10552 · NVD
Track software like this
Free during beta