3DSwymer CVE-2025-10552

Exploitation requires the attacker to inject a script payload into persistently stored 3DSwym content (the social-collaboration module of 3DEXPERIENCE R2025x), which in practice typically requires access to a content-submission feature such as posts, comments, or profile fields. Successful execution additionally requires a victim to view the affected page (CVSS UI:R), so it is not a silent server-side compromise. Limiting factors: the attack is confined to the 3DSwym component on the R2025x release, impact is limited to the browser session (C:L/I:L, A:N - no availability impact), and the vendor's PR:N rating is questionable because storing the payload most likely requires at least a low-privileged authenticated account on the platform.

This is a moderate-severity stored XSS (CWE-79) with a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Multiple real-world signals point to LOW immediate priority: EPSS is only 0.20% (9th percentile), it is NOT listed in CISA KEV, and no public proof-of-concept was identified, giving an exploitation status of 'no public exploit identified at time of analysis.' The signals are internally consistent - low likelihood, no confirmed exploitation - so this is a genuine moderate issue rather than an over-scored one, and conversely not a hidden high-risk item. One notable tension: the vendor-supplied vector states PR:N (no privileges), yet stored XSS in a social-collaboration module (3DSwym) typically requires an authenticated account to persist the malicious payload into stored content; PR:N likely reflects a worst-case/public-posting scenario and should be verified against how 3DSwym content submission is actually gated. UI:R confirms a victim must view the affected page, and S:C reflects the script executing in the victim's browser context outside the vulnerable component's security scope. No SSVC decision data was provided in the input.

An attacker who can submit content to a 3DSwym community (e.g., a post, comment, or profile field) injects a malicious script payload that is stored server-side. When another authenticated user later views that content, the script executes in their browser session, enabling session token theft, actions on their behalf, or UI manipulation. No public exploit code is known, and successful attack requires the victim to load the poisoned page (UI:R).