CVE-2025-27380

—

CVSS 3.1

7.6 high

EPSS

<1%p16

Published

Jan 22, 2026 (Jan 22, 2026)

Modified

Jun 17, 2026

Description

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.

Vendors: altium
Products: on-prem enterprise server
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.