The flaw is a reflected Cross‑Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary script code in the victim’s browser session whenever a malicious request is made to ENOVIAvpm Web Access. The vulnerability is a classic input validation weakness (CWE‑79). The potential impact is limited to execution of code within the victim’s browser context; the CVE description does not indicate additional data exfiltration or session hijacking beyond that scope.

Dassault Systèmes ENOVIAvpm Web Access versions 1 Release 16 through 1 Release 19 are affected. Systems running any of these releases should confirm their installed version and take remediation action.

The CVSS score of 8.7 signals a high severity flaw. The EPSS score of < 1 % shows that exploitation has not been observed in the wild and is likely low. Because the flaw is reflected XSS, an attacker would need to craft a malicious URL or input and persuade a user to load it, so the attack vector requires user interaction with a malformed request. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at present.