CVE-2025-27380 - CVE House

Status published High CVE-2025-27380

HTML Injection Leading to Script Execution in Altium Enterprise Server

7.6 CVSS

Vulnerability Description

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27380

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://www.altium.com/platform/security-compliance/security-advisories

More from Altium

View All →

CVE-2025-27379

Stored Cross-Site Scripting in AES BOM Viewer

Medium 6.8

CVE-2025-27378

SQL Injection in AES Due to Inactive SQL Parsing Configuration

High 8.6

CVE-2025-27377

Missing Validation of Self-Signed Certificates in Altium Designer Allows Man-in-the-Middle Attacks

Medium 5.3

Affected Vendor

Altium

View all reports →

Affected Software

AES

Vulnerable Versions:

7.0.3

Timeline

Official Publish: January 22nd, 2026

Last Modified: January 22nd, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

Initial Access

T1059.007 JavaScript

Execution

T1539 Steal Web Session Cookie

Collection

T1213 Data from Information Repositories