ENOVIA Collaborative Industry Innovator CVE-2025-10557

Exploitation requires an authenticated account (PR:L) with permission to create or edit content in the Issue Management module of ENOVIA Collaborative Industry Innovator (3DEXPERIENCE R2022x through R2025x), and a second victim user must subsequently view the attacker-controlled issue data (UI:R) for the stored script to execute. Limiting factors: the attacker must already have a valid, sufficiently privileged login to the 3DEXPERIENCE platform; no exploitation occurs without victim interaction; and impact is confined to the Low confidentiality/integrity effects achievable via script execution in the victim's browser session, with no availability impact.

This is a moderate-severity, low-priority issue in practice. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a network-reachable but authenticated (PR:L) stored XSS that additionally requires victim interaction (UI:R) to fire, with only Low confidentiality and integrity impact and a scope change (S:C) reflecting that the payload executes in a separate browser context. All exploitation signals point the same direction: EPSS is 0.20% (9th percentile), indicating very low predicted exploitation probability; there is no CISA KEV listing and no public POC referenced, so this is not under active or imminent broad exploitation. No SSVC decision data was provided in the input. The signals are internally consistent - a low-privileged authenticated user stores a payload that fires when another user views the affected Issue Management content - so there is no major conflict to flag. The one modest caveat is the typical XSS tension: the vector marks AV:N, but real exploitation requires an authenticated foothold in the ENOVIA tenant first, so the effective attack surface is narrower than 'network/unauthenticated' alone would suggest.

A low-privileged but authenticated user of ENOVIA Collaborative Industry Innovator injects a malicious script into an Issue Management field (e.g., an issue description or comment). When another user - potentially a higher-privileged reviewer or administrator - opens that issue, the stored script executes in their browser session, enabling session-context actions such as cookie/token theft or UI redressing. No public exploit code was identified in the provided data, so an attacker would need to craft the payload themselves.