CVE-2025-27380

7.6 highEPSS 0.3%

High (7.6) in altium on-prem enterprise server. EPSS 0.3% chance of exploitation in the next 30 days.

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.

Severity

CVSS 3.1

7.6 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-01-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

altium:on-prem_enterprise_server

References

https://www.altium.com/platform/security-compliance/security-advisories

Check your stack JSON