PT-2025-23304 · Unknown+1 · Collaborative Industry Innovator+1

Published 2025-05-30 · Updated 2025-05-30 · CVE-2025-4991

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Collaborative Industry Innovator versions R2022x through R2025x

Description A stored Cross-site Scripting (XSS) vulnerability in 3D Markup allows an attacker to execute arbitrary script code in a user's browser session. This issue affects the Collaborative Industry Innovator and enables attackers to run malicious scripts in user browsers.

Recommendations For versions R2022x through R2025x, consider disabling the 3D Markup feature in Collaborative Industry Innovator until a patch is available to prevent the execution of arbitrary script code in user browser sessions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-11567

CVE-2025-4991

Affected Products

3D Markup

Collaborative Industry Innovator

References · 6

• https://bdu.fstec.ru/vul/2025-11567 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4991 · Security Note
• https://twitter.com/CveFindCom/status/1928461484943618187 · Twitter Post
• https://3ds.com/vulnerability/advisories · Note
• https://t.me/cvetracker/25024 · Telegram Post
• https://twitter.com/CVEnew/status/1928466840247779832 · Twitter Post