A stored cross‑site scripting vulnerability exists in the Document Management component of Dassault Systèmes ENOVIA Collaborative Industry Innovator. The flaw allows a malicious user to store script code that is later rendered in other users’ browsers, enabling arbitrary client‑side code execution. This can lead to session hijacking, the theft of sensitive data, or interface defacement. The weakness is characterized as CWE‑79.

The vulnerability impacts Dassault Systèmes ENOVIA Collaborative Industry Innovator in 3DEXPERIENCE releases from R2023x through R2025x.

The CVSS score of 8.7 indicates high severity, yet the EPSS score of less than 1% reflects a low probability of exploitation. The issue is not listed in the CISA KEV catalog. Attackers would need to inject malicious content via the document submission or management interface; the content is stored and later served to users, providing the attack vector.