CVE-2025-0152

MediumCVSS 6.1

Published: 30/07/2026(UTC)Updated: 29/09/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

18th percentile - higher than 18% of all known CVEs

Summary

IBM Engineering Requirements Management DOORS and DOORS Web Access are vulnerable to cross-site scripting (XSS). An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI.

Risk Assessment

This could lead to credential disclosure within a trusted user session, enabling account takeover.

Recommendation

Update to version 9.7.2.12 or 9.6.1.14 and implement anti-XSS filters in the application.

Other vulnerabilities in IBM Engineering Requirements Management DOORS

CVE-2024-25039High
IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.7.2.1 through 9.7.2.11 and 9.6.1.1 through 9.6.1.13 do not limit connection length, allowing a Slowloris HTTP denial of service attack. This can cause the web server to become unresponsive.

Original NVD description (English source)

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS