HIGH🇵🇱 Wersja polska

CVE-2025-27380

CVSS 7.6v3.1pub. 2026-01-22upd. 2026-02-26

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

  • Altium On Prem Enterprise Server

    APP
    Altium
    7.0.3 – 7.0.6 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2026-11414CRITICAL10.0PL ✓ten sam produkt

Altium Enterprise Server: hardcoded key + path traversal umożliwiają przejęcie serwera

CVE-2026-11419CRITICAL9.4PL ✓ten sam produkt

Path traversal w Altium Enterprise Server Vault Service — zapis dowolnych plików i RCE

CVE-2026-11420CRITICAL10.0PL ✓ten sam produkt

Path Traversal w Altium Enterprise Server NIS — nieuwierzytelniony RCE

CVE-2025-27378HIGH8.6ten sam produkt

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsi...

CVE-2026-1010HIGH8.0ten sam produkt

A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-s...