Dassault Syst Mes
Monthly
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
Authorization bypass in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker who already holds tracker administration rights on one tracker to update or delete fields belonging to other trackers on the same instance. The flaw is a CWE-639 user-controlled key authorization bypass rated CVSS 8.1 with high integrity and availability impact, but it requires a low-privilege tracker-admin role (PR:L) and affects only the stated versions. No public exploit identified at time of analysis, and no confirmed active exploitation, though practical risk is highest in large multi-team deployments where many trackers share one instance.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an attacker holding a low-privileged authenticated account to persist arbitrary script into content that is later rendered in another user's browser, where it executes within that victim's authenticated session (CVSS 3.1 base 8.7, scope-changed). Exploitation is not unilateral: it requires a valid account with enough privilege to submit persistent content into a field shown to other users (PR:L) plus a victim who views the poisoned content (UI:R), so practical severity depends on how many users - and how privileged those users - can be induced to open the crafted page. No public exploit identified at time of analysis, and no EPSS or CISA KEV corroboration of active exploitation was supplied with the intelligence.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated user with only low privileges to persist malicious script content into application fields, which then executes in the browser session of any other user who views the poisoned page. Because the payload is stored rather than reflected, a single injection can fire repeatedly against multiple victims, including higher-privileged users, and the CVSS scope change (S:C) reflects that the script runs with the privileges of the victim's origin rather than the attacker's account. Exploitation requires valid credentials (PR:L) and victim interaction (UI:R), and no public exploit code was identified at time of analysis; no EPSS score, CISA KEV entry, or active-exploitation reporting was provided in the available intelligence.
Stored cross-site scripting (XSS) in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker to inject malicious script into a persisted field, which then executes in the browser session of any user who views the affected content. The vulnerability requires a low-privileged account (PR:L) and user interaction (UI:R) from a victim, and can lead to high confidentiality and integrity impact. No public exploit identified at time of analysis.
OS command injection in Tuleap Enterprise Edition versions 17.0 through 17.5 allows an authenticated, low-privilege user to execute arbitrary commands on the underlying server, delivering a full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the assessed vector specifies PR:L, exploitation requires a valid account on the target instance - a registered project or site user is sufficient - and no user interaction is needed once that access is obtained, so unauthenticated attackers cannot trigger it directly. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied in the source data. Practical risk is therefore concentrated on internet-reachable Tuleap Enterprise Edition instances in the 17.0-17.5 range that allow self-registration or broad account provisioning, since such deployments effectively lower the credential barrier to exploitation.
Authenticated code injection in Dassault Systèmes GEOVIA Geospatial Data Manager allows a low-privilege user with a valid session to execute arbitrary code on the server, and the changed-scope metric means the compromised component can be leveraged to affect other parts of the hosting 3DEXPERIENCE environment. The flaw carries a 9.9 CVSS score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects GEOVIA Geospatial Data Manager deployed on 3DEXPERIENCE R2024x through R2026x up to the listed FP.CFA build levels; no user interaction is required beyond the attacker's own authenticated access. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical exposure is gated by the requirement for a valid low-privilege account and by the product's narrow mining and geospatial deployment footprint.
OS command injection in Dassault Systèmes Tuleap Enterprise Edition versions 17.3 through 17.5 allows an authenticated remote attacker with a low-privilege account to execute arbitrary operating system commands on the server, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 8.8. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the potential for full server compromise makes this a genuine high-priority issue that is not a drop-everything emergency. Instances are only affected if they run versions 17.3-17.5 and permit low-privilege authenticated access, so environments with tightly controlled account provisioning or network restrictions face reduced exposure.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Unauthenticated remote code execution in Dassault Systèmes SIMULIA Execution Engine (Release 2023 through Release 2026) allows a network attacker to run arbitrary code on the server by submitting a malicious serialized object that the application deserializes without validation. The flaw carries a maximum CVSS 3.1 base score of 10.0 and requires no privileges or user interaction, making any exposed instance fully compromisable. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause combined with a network attack vector makes it a high-priority patching target.
Insecure direct object reference (IDOR) in Dassault Systèmes Tuleap Enterprise Edition 17.0 through 17.5 lets attackers read other users' data by manipulating a user-controlled key/identifier, breaking horizontal authorization boundaries. The CVSS 3.1 vector (AV:N/PR:N) scores it as remotely reachable with high confidentiality impact but no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Dassault Systèmes DELMIA Apriso (Release 2020 through Release 2026) lets remote unauthenticated attackers obtain privileged access to the manufacturing operations server, consistent with the CVSS PR:N/UI:N metrics. Rated CVSS 9.8 (C:H/I:H/A:H), it exposes shop-floor and production-control functions to full compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized cross-user data access in Dassault Systèmes BIOVIA Workbook (Release 2021 through Release 2026) stems from a race condition that lets one authenticated low-privilege user read data belonging to another user. Vendor 3DS tags the flaw as an authentication bypass, and its CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L) reflects network-reachable exploitation by any authenticated account with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and no EPSS or KEV signal supplied.
Arbitrary file write via path traversal in SOLIDWORKS Visualize (bundled with SOLIDWORKS Desktop 2024 through 2026) allows remote attackers to place files at attacker-chosen locations on the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with high impact across confidentiality, integrity, and availability. At time of analysis, no public exploit identified and the issue is not on the CISA KEV list.
A code injection vulnerability in SOLIDWORKS Desktop releases 2025 through 2026 allows attackers to execute arbitrary code on victim machines by tricking users into opening specially crafted files. The vulnerability requires local access and user interaction but provides complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 7.8). No evidence of active exploitation or proof-of-concept code has been reported.
Path traversal in DELMIA Factory Resource Manager (3DEXPERIENCE R2023x through R2025x) allows authenticated remote attackers to read sensitive files and write files to specific server directories. The vulnerability affects the Factory Resource Management component and requires low-privilege authentication (CVSS PR:L) with low attack complexity. EPSS data not available; no public exploit identified at time of analysis. This represents a significant data exposure risk in industrial manufacturing environments using Dassault Systèmes' 3DEXPERIENCE platform.
Stored cross-site scripting in Dassault Systèmes DELMIA Factory Resource Manager (R2023x through R2025x) allows authenticated attackers to inject malicious scripts that execute in victims' browser sessions with changed scope impact. CVSS 8.7 severity reflects the scope change (S:C) enabling attacks beyond the vulnerable component's privileges. No public exploit code identified and not listed in CISA KEV at time of analysis, though the low attack complexity (AC:L) indicates straightforward exploitation once authenticated access is obtained.
Stored Cross-Site Scripting (XSS) in Dassault Systèmes ENOVIA Collaborative Industry Innovator's Document Management module enables authenticated attackers to inject malicious scripts that execute in other users' browser sessions across 3DEXPERIENCE releases R2023x through R2025x. With CVSS 8.7 (High severity) and scope change (S:C), successful exploitation allows session hijacking, credential theft, and persistent compromise of users accessing manipulated documents. EPSS data not available; no public exploit identified at time of analysis, though the low attack complexity (AC:L) makes exploitation straightforward once an attacker gains low-privilege access (PR:L).
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
Authorization bypass in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker who already holds tracker administration rights on one tracker to update or delete fields belonging to other trackers on the same instance. The flaw is a CWE-639 user-controlled key authorization bypass rated CVSS 8.1 with high integrity and availability impact, but it requires a low-privilege tracker-admin role (PR:L) and affects only the stated versions. No public exploit identified at time of analysis, and no confirmed active exploitation, though practical risk is highest in large multi-team deployments where many trackers share one instance.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an attacker holding a low-privileged authenticated account to persist arbitrary script into content that is later rendered in another user's browser, where it executes within that victim's authenticated session (CVSS 3.1 base 8.7, scope-changed). Exploitation is not unilateral: it requires a valid account with enough privilege to submit persistent content into a field shown to other users (PR:L) plus a victim who views the poisoned content (UI:R), so practical severity depends on how many users - and how privileged those users - can be induced to open the crafted page. No public exploit identified at time of analysis, and no EPSS or CISA KEV corroboration of active exploitation was supplied with the intelligence.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated user with only low privileges to persist malicious script content into application fields, which then executes in the browser session of any other user who views the poisoned page. Because the payload is stored rather than reflected, a single injection can fire repeatedly against multiple victims, including higher-privileged users, and the CVSS scope change (S:C) reflects that the script runs with the privileges of the victim's origin rather than the attacker's account. Exploitation requires valid credentials (PR:L) and victim interaction (UI:R), and no public exploit code was identified at time of analysis; no EPSS score, CISA KEV entry, or active-exploitation reporting was provided in the available intelligence.
Stored cross-site scripting (XSS) in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker to inject malicious script into a persisted field, which then executes in the browser session of any user who views the affected content. The vulnerability requires a low-privileged account (PR:L) and user interaction (UI:R) from a victim, and can lead to high confidentiality and integrity impact. No public exploit identified at time of analysis.
OS command injection in Tuleap Enterprise Edition versions 17.0 through 17.5 allows an authenticated, low-privilege user to execute arbitrary commands on the underlying server, delivering a full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the assessed vector specifies PR:L, exploitation requires a valid account on the target instance - a registered project or site user is sufficient - and no user interaction is needed once that access is obtained, so unauthenticated attackers cannot trigger it directly. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied in the source data. Practical risk is therefore concentrated on internet-reachable Tuleap Enterprise Edition instances in the 17.0-17.5 range that allow self-registration or broad account provisioning, since such deployments effectively lower the credential barrier to exploitation.
Authenticated code injection in Dassault Systèmes GEOVIA Geospatial Data Manager allows a low-privilege user with a valid session to execute arbitrary code on the server, and the changed-scope metric means the compromised component can be leveraged to affect other parts of the hosting 3DEXPERIENCE environment. The flaw carries a 9.9 CVSS score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects GEOVIA Geospatial Data Manager deployed on 3DEXPERIENCE R2024x through R2026x up to the listed FP.CFA build levels; no user interaction is required beyond the attacker's own authenticated access. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical exposure is gated by the requirement for a valid low-privilege account and by the product's narrow mining and geospatial deployment footprint.
OS command injection in Dassault Systèmes Tuleap Enterprise Edition versions 17.3 through 17.5 allows an authenticated remote attacker with a low-privilege account to execute arbitrary operating system commands on the server, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 8.8. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the potential for full server compromise makes this a genuine high-priority issue that is not a drop-everything emergency. Instances are only affected if they run versions 17.3-17.5 and permit low-privilege authenticated access, so environments with tightly controlled account provisioning or network restrictions face reduced exposure.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Unauthenticated remote code execution in Dassault Systèmes SIMULIA Execution Engine (Release 2023 through Release 2026) allows a network attacker to run arbitrary code on the server by submitting a malicious serialized object that the application deserializes without validation. The flaw carries a maximum CVSS 3.1 base score of 10.0 and requires no privileges or user interaction, making any exposed instance fully compromisable. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-502 root cause combined with a network attack vector makes it a high-priority patching target.
Insecure direct object reference (IDOR) in Dassault Systèmes Tuleap Enterprise Edition 17.0 through 17.5 lets attackers read other users' data by manipulating a user-controlled key/identifier, breaking horizontal authorization boundaries. The CVSS 3.1 vector (AV:N/PR:N) scores it as remotely reachable with high confidentiality impact but no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Dassault Systèmes DELMIA Apriso (Release 2020 through Release 2026) lets remote unauthenticated attackers obtain privileged access to the manufacturing operations server, consistent with the CVSS PR:N/UI:N metrics. Rated CVSS 9.8 (C:H/I:H/A:H), it exposes shop-floor and production-control functions to full compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized cross-user data access in Dassault Systèmes BIOVIA Workbook (Release 2021 through Release 2026) stems from a race condition that lets one authenticated low-privilege user read data belonging to another user. Vendor 3DS tags the flaw as an authentication bypass, and its CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L) reflects network-reachable exploitation by any authenticated account with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and no EPSS or KEV signal supplied.
Arbitrary file write via path traversal in SOLIDWORKS Visualize (bundled with SOLIDWORKS Desktop 2024 through 2026) allows remote attackers to place files at attacker-chosen locations on the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with high impact across confidentiality, integrity, and availability. At time of analysis, no public exploit identified and the issue is not on the CISA KEV list.
A code injection vulnerability in SOLIDWORKS Desktop releases 2025 through 2026 allows attackers to execute arbitrary code on victim machines by tricking users into opening specially crafted files. The vulnerability requires local access and user interaction but provides complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 7.8). No evidence of active exploitation or proof-of-concept code has been reported.
Path traversal in DELMIA Factory Resource Manager (3DEXPERIENCE R2023x through R2025x) allows authenticated remote attackers to read sensitive files and write files to specific server directories. The vulnerability affects the Factory Resource Management component and requires low-privilege authentication (CVSS PR:L) with low attack complexity. EPSS data not available; no public exploit identified at time of analysis. This represents a significant data exposure risk in industrial manufacturing environments using Dassault Systèmes' 3DEXPERIENCE platform.
Stored cross-site scripting in Dassault Systèmes DELMIA Factory Resource Manager (R2023x through R2025x) allows authenticated attackers to inject malicious scripts that execute in victims' browser sessions with changed scope impact. CVSS 8.7 severity reflects the scope change (S:C) enabling attacks beyond the vulnerable component's privileges. No public exploit code identified and not listed in CISA KEV at time of analysis, though the low attack complexity (AC:L) indicates straightforward exploitation once authenticated access is obtained.
Stored Cross-Site Scripting (XSS) in Dassault Systèmes ENOVIA Collaborative Industry Innovator's Document Management module enables authenticated attackers to inject malicious scripts that execute in other users' browser sessions across 3DEXPERIENCE releases R2023x through R2025x. With CVSS 8.7 (High severity) and scope change (S:C), successful exploitation allows session hijacking, credential theft, and persistent compromise of users accessing manipulated documents. EPSS data not available; no public exploit identified at time of analysis, though the low attack complexity (AC:L) makes exploitation straightforward once an attacker gains low-privilege access (PR:L).