A stored cross‑site scripting vulnerability exists in the Process Experience Studio module of DELMIA Service Process Engineer. The flaw enables an attacker to embed malicious script payloads in data fields that are later rendered within users’ browsers. When an affected user views the stored data, the browser executes the injected script, potentially resulting in session hijacking, credential theft, or defacement of the application.

Dassault Systèmes DELMIA Service Process Engineer is affected. The issue spans Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x.

The CVSS score of 8.7 reflects a high‑impact, client‑side flaw. No EPSS score is available, and the vulnerability is not listed in CISA KEV, so the exploitation probability remains uncertain. Attackers would likely need the ability to insert data into the affected fields—either by leveraging legitimate user credentials or by compromising a user account with write access. The attack vector is client‑side, depending on stored inputs that are rendered in the victim’s browser.