CVE-2025-36121

MediumCVSS 5.4

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed would be executed in the victim's Web browser within the security context of the hosting site.

Risk Assessment

This may result in malicious code execution in the user's browser and potential session compromise or data disclosure.

Recommendation

Update IBM OpenPages to a patched version and enforce input validation/sanitization in the web interface.

Other vulnerabilities in IBM OpenPages

CVE-2025-33110Medium
IBM OpenPages 9.1 and 9.0 with Watson is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Original NVD description (English source)

IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS