Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2025-27379

Stored Cross-Site Scripting in AES BOM Viewer

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Altium

Description

A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when the BOM Viewer renders the affected content.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Altium AES

Default version status: unaffected

  • 7.0.3 to ≤ 7.0.5affected

References