What is the CVSS score of CVE-2025-4987?

CVE-2025-4987 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Opportunity Management are affected by CVE-2025-4987?

A stored XSS vulnerability in Dassault Systèmes' Project Portfolio Manager (3DEXPERIENCE R2023x-R2025x) allows attackers to inject malicious scripts that execute in user browsers, potentially…

How to fix or mitigate CVE-2025-4987?

Within 24 hours: Inventory all Project Portfolio Manager instances and document affected versions; notify users to avoid untrusted Opportunity Management inputs; enable enhanced logging. Within 7 days: Deploy WAF rules to block script payloads in Opportunity Management fields; implement network segmentation to restrict PPM access to authorized users only; consider disabling Opportunity Management feature if non-critical. Within 30 days: Monitor vendor communications for patch availability; conduct security awareness training on XSS risks; perform audit of Opportunity Management data for injected content.

Opportunity Management CVE-2025-4987

EUVD-2025-18374 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-16 3DS.Information-Security@3ds.com

XSS

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:59 euvd

EUVD-2025-18374

Analysis Generated

Mar 14, 2026 - 21:59 vuln.today

CVE Published

Jun 16, 2025 - 08:15 nvd

HIGH 8.7

DescriptionCVE.org

A stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.