A cross‑site scripting flaw exists in Siemens Teamcenter, caused by a lack of proper encoding or filtering of user‑supplied data. This flaw permits an attacker to embed malicious script in a page that is then executed by any other user who visits that page, potentially impacting confidentiality, integrity, or availability. The depth of the impact is not detailed in the CVE but is inferred from typical XSS outcomes. The weakness is a classic output‑encoding issue (CWE‑79).

Siemens Teamcenter products are affected: V2312 (all versions prior to 2312.0014), V2406 (prior to 2406.0012), V2412 (prior to 2412.0009), V2506 (prior to 2506.0005), and all releases of V2512. All of these versions lack proper input validation that would prevent malicious script injection.

The vulnerability carries a CVSS score of 8.5, indicating a high‑severity risk. The EPSS score is not available, so the exact exploitation probability cannot be quantified. Exploitation would require an attacker to manipulate input data that the application reflects without filtering, allowing the victim’s browser to execute injected code. The vulnerability is not currently listed in the CISA KEV catalog, but the high severity and widespread deployment make it a prime target for attackers. The attack vector likely involves a web application wherein a user can submit data that is subsequently displayed to other users.