CVE-2025-4984: Dassault Systèmes City Referential Manager

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

A stored Cross-site Scripting (XSS) vulnerability affecting City Discover in City Referential Manager on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Affected products

• Dassault Systèmes City Referential Manager: version 3DEXPERIENCE R2025x Golden only

Published 2025-05-30. Last modified 2026-06-17.