{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10553", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "state": "PUBLISHED", "assignerShortName": "3DS", "dateReserved": "2025-09-16T12:56:37.160Z", "datePublished": "2026-03-31T08:41:35.663Z", "dateUpdated": "2026-03-31T13:32:40.143Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2026-03-31T08:41:35.663Z"}, "title": "Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Factory Resource Manager", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2541", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2024x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2537", "versionType": "custom"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2025x Golden", "lessThanOrEqual": "Release 3DEXPERIENCE R2025x.FP.CFA.2514", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session."}]}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10553"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "baseScore": 8.7, "baseSeverity": "HIGH"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T13:32:32.743232Z", "id": "CVE-2025-10553", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:32:40.143Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10553", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T13:32:32.743232Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T13:32:36.655Z"}}], "cna": {"title": "Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dassault Syst\u00e8mes", "product": "DELMIA Factory Resource Manager", "versions": [{"status": "affected", "version": "Release 3DEXPERIENCE R2023x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2023x.FP.CFA.2541"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2024x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2024x.FP.CFA.2537"}, {"status": "affected", "version": "Release 3DEXPERIENCE R2025x Golden", "versionType": "custom", "lessThanOrEqual": "Release 3DEXPERIENCE R2025x.FP.CFA.2514"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10553"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.", "supportingMedia": [{"type": "text/html", "value": "A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "shortName": "3DS", "dateUpdated": "2026-03-31T08:41:35.663Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10553", "state": "PUBLISHED", "dateUpdated": "2026-03-31T13:32:40.143Z", "dateReserved": "2025-09-16T12:56:37.160Z", "assignerOrgId": "f5a594e6-46a7-4e60-8a08-0a786e70e433", "datePublished": "2026-03-31T08:41:35.663Z", "assignerShortName": "3DS"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:3ds:3dexperience:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D800681-01F0-43E4-9525-BE188167D292", "versionEndIncluding": "r2025x", "versionStartIncluding": "r2023x", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado que afecta a la Gesti\u00f3n de Recursos de F\u00e1brica en DELMIA Factory Resource Manager desde la versi\u00f3n 3DEXPERIENCE R2023x hasta la versi\u00f3n 3DEXPERIENCE R2025x permite a un atacante ejecutar c\u00f3digo de script arbitrario en la sesi\u00f3n del navegador del usuario."}], "id": "CVE-2025-10553", "lastModified": "2026-04-06T15:17:33.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "3DS.Information-Security@3ds.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-31T09:16:21.823", "references": [{"source": "3DS.Information-Security@3ds.com", "tags": ["Vendor Advisory"], "url": "https://www.3ds.com/trust-center/security/security-advisories/cve-2025-10553"}], "sourceIdentifier": "3DS.Information-Security@3ds.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "3DS.Information-Security@3ds.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[Release 3DEXPERIENCE R2023x Golden,Release 3DEXPERIENCE R2023x.FP.CFA.2541]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[Release 3DEXPERIENCE R2024x Golden,Release 3DEXPERIENCE R2024x.FP.CFA.2537]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[Release 3DEXPERIENCE R2025x Golden,Release 3DEXPERIENCE R2025x.FP.CFA.2514]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DELMIA Factory Resource Manager", "source": "cna", "vendor": "Dassault Syst\u00e8mes"}, "product": "delmia_factory_resource_manager", "vendor": "dassault_syst\u00e8mes"}], "analysis": {"en": {"generated_at": "2026-04-06T17:54:51.463408+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011issued patch or upgrade to a version later than 3DEXPERIENCE\u202fR2025x", "Verify that the application no longer reflects unescaped user input in the UI", "If a patch is not yet available, restrict user permissions to create or edit affected data until remediation", "Monitor web application logs for suspicious script references or injection attempts"], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting (user\u2011session compromise)"}, "threat_synthesis": {"affected_systems": "Dassault\u202fSyst\u00e8mes DELMIA Factory Resource Manager from Release\u202f3DEXPERIENCE\u202fR2023x through Release\u202f3DEXPERIENCE\u202fR2025x is vulnerable.", "description_and_impact": "A stored cross\u2011site scripting flaw permits an attacker to embed malicious script into data that the Factory Resource Manager persists. When the affected content is later rendered in a user\u2019s browser, the script runs with the victim\u2019s session credentials, enabling session hijacking, data theft, or the execution of additional client\u2011side attacks.", "risk_and_exploitability": "The CVSS score of 8.7 indicates high severity, yet the EPSS score of less than 1% suggests exploitation is unlikely and the vulnerability is not listed in the CISA KEV catalog. Attack likely requires the ability to submit or modify data that the application will later display; therefore, an authenticated user with sufficient privileges is probably needed, as the description does not confirm unauthenticated exploitation. Once the malicious content is stored, any user who views the data will execute the script in their browser, creating a wide attack surface."}}}}, "created": "2026-03-31T19:56:02.396744+00:00", "updated": "2026-04-07T08:08:09.556938+00:00", "vendors": ["dassault_syst\u00e8mes", "dassault_syst\u00e8mes$PRODUCT$delmia_factory_resource_manager"]}