PT-2026-7250 · Siemens · Polarion

Published 2026-02-10 · Updated 2026-02-12 · CVE-2025-40587

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Polarion versions prior to 2404.5 Polarion versions prior to 2410.2

Description The application allows arbitrary JavaScript code to be included in document titles. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by creating specially crafted document titles that are later viewed by other users of the application. The attack involves manipulating document titles to inject malicious JavaScript code.

Recommendations Update Polarion to version 2404.5 or later. Update Polarion to version 2410.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-02000

CVE-2025-40587

Affected Products

Polarion

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-40587 · Security Note
• https://bdu.fstec.ru/vul/2026-02000 · Security Note
• https://t.me/CVEtracker/44289 · Telegram Post
• https://twitter.com/CVEnew/status/2021171951855861831 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-035571.html · Note
• https://twitter.com/ThreatSynop/status/2022011723679461633 · Twitter Post