{"id":"CVE-2026-33862","aliases":["EUVD-2026-29430","GHSA-4pjx-495c-f5cg"],"status":"published","title":"A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter...","description":"A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter V2406 (All versions \u003c V2406.0012), Teamcenter V2412 (All versions \u003c V2412.0009), Teamcenter V2506 (All versions \u003c V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00192,"percentile":0.09006,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-05-12T08:21:14Z","modified":"2026-10-23T23:10:00Z","products":[{"vendor":"siemens","product":"teamcenter"},{"vendor":"siemens","product":"teamcenter v2312"},{"vendor":"siemens","product":"teamcenter v2406"},{"vendor":"siemens","product":"teamcenter v2412"},{"vendor":"siemens","product":"teamcenter v2506"},{"vendor":"siemens","product":"teamcenter v2512"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-827383.html","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33862"},{"url":"https://github.com/advisories/GHSA-4pjx-495c-f5cg"}],"sources":{"cve":[{"id":"CVE-2026-33862","description":"A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter V2406 (All versions \u003c V2406.0012), Teamcenter V2412 (All versions \u003c V2412.0009), Teamcenter V2506 (All versions \u003c V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.","status":"published","published":"2026-05-12T08:21:14.646Z","modified":"2026-05-13T01:48:31.646Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-29430","description":"A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter V2406 (All versions \u003c V2406.0012), Teamcenter V2412 (All versions \u003c V2412.0009), Teamcenter V2506 (All versions \u003c V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.","status":"published","published":"2026-05-12T08:21:14Z","modified":"2026-05-13T01:48:31Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:04:34.771814Z"}],"ghsa":[{"id":"GHSA-4pjx-495c-f5cg","title":"A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter...","description":"A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter V2406 (All versions \u003c V2406.0012), Teamcenter V2412 (All versions \u003c V2412.0009), Teamcenter V2506 (All versions \u003c V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.","status":"published","published":"2026-05-12T12:32:14Z","modified":"2026-05-12T12:32:21Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:08:01.880471Z"}],"nvd":[{"id":"CVE-2026-33862","description":"A vulnerability has been identified in Teamcenter V2312 (All versions \u003c V2312.0014), Teamcenter V2406 (All versions \u003c V2406.0012), Teamcenter V2412 (All versions \u003c V2412.0009), Teamcenter V2506 (All versions \u003c V2506.0005), Teamcenter V2512 (All versions). The affected application does not properly encode or filter user-supplied data. This could allow an attacker to inject malicious code that can be executed by other users when they visit the affected page.","status":"published","published":"2026-05-12T10:16:45.773Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:18.613259Z"}]}}