What’s Vulnerable › Vulnerabilities
CVE-2025-40587
- Severity: high (CVSS 7.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-10 · updated 2026-06-17
- Weakness: CWE-79
Description
A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2). The affected application allows arbitrary JavaScript code be included in document titles. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by creating specially crafted document titles that are later viewed by other users of the application.
Affected products
- Siemens Polarion V2404: before V2404.5 — fixed in V2404.5
- Siemens Polarion V2410: before V2410.2 — fixed in V2410.2
How to fix
Upgrade to a fixed version: Siemens Polarion V2404 V2404.5; Siemens Polarion V2410 V2410.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-40587 or the next vulnerability affects your stack