CVE-2025-4986

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

A stored Cross-site Scripting (XSS) vulnerability affecting Model Definition in Product Manager from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Dassault Systèmes	Product Manager	>= Release 3DEXPERIENCE R2022x Golden, <= Release 3DEXPERIENCE R2022x.FP.CFA.2442; >= Release 3DEXPERIENCE R2023x Golden, <= Release 3DEXPERIENCE R2023x.FP.CFA.2446; >= Release 3DEXPERIENCE R2024x Golden, <= Release 3DEXPERIENCE R2024x.FP.CFA.2441; Release 3DEXPERIENCE R2025x Golden

References

https://www.3ds.com/vulnerability/advisories

Timeline

Published: May 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-498605.3Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a thro CVE-2025-498616.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timur Kamaev Kama Click Counter kama-c CVE-2025-498625.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in motov.net Ebook Store ebook-store allo CVE-2025-498636.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-se CVE-2025-498645.3Missing Authorization vulnerability in AFS Analytics AFS Analytics addfreestats allows Accessing Functionality Not Properly Constrained by A CVE-2025-498654.3Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This i CVE-2025-498667.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner CVE-2025-498679.8Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: CVE-2025-498684.7URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.Thi CVE-2025-498698.8Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: f CVE-2025-49878.7A stored Cross-site Scripting (XSS) vulnerability affecting Opportunity Management in Project Portfolio Manager from Release 3DEXPERIENCE R2 CVE-2025-498707.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions p