CVE-2025-27380highCWE-79

CVE-2025-27380: high-severity vulnerability in Altium AES

HTML Injection Leading to Script Execution in Altium Enterprise Server

Published

Follow this CVE+ Monitor AES

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.6epss 0.3%
HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected products
Altium · AES
Related CVEs — Altium AES

In the same product, most dangerous first.

CVE-2025-27378HIGHSQL Injection in AES Due to Inactive SQL Parsing ConfigurationEPSS 0.4%CVE-2025-27379MEDIUMStored Cross-Site Scripting in AES BOM ViewerEPSS 0.2%