CVE-2025-27379 — Stored Cross-Site Scripting in AES BOM Viewer

CVE-2025-27379

Stored Cross-Site Scripting in AES BOM Viewer PUBLISHED

Description (CNA)

A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content.

Affected (CNA)

Vendor / product	Versions
Altium / AES	affected 7.0.3 through 7.0.5

CWE

CWE-79

References

https://www.altium.com/platform/security-compliance/security-advisories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.