A stored cross‑site scripting flaw permits an attacker to embed malicious script into data that the Factory Resource Manager persists. When the affected content is later rendered in a user’s browser, the script runs with the victim’s session credentials, enabling session hijacking, data theft, or the execution of additional client‑side attacks.

Dassault Systèmes DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x is vulnerable.

The CVSS score of 8.7 indicates high severity, yet the EPSS score of less than 1% suggests exploitation is unlikely and the vulnerability is not listed in the CISA KEV catalog. Attack likely requires the ability to submit or modify data that the application will later display; therefore, an authenticated user with sufficient privileges is probably needed, as the description does not confirm unauthenticated exploitation. Once the malicious content is stored, any user who views the data will execute the script in their browser, creating a wide attack surface.