CVE-2025-36230
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session data theft, account takeover, or modification of content displayed to the user. The vulnerability can be exploited for phishing attacks and malware distribution.
Recommendation
Update IBM Aspera Faspex 5 to the latest version (above 5.0.14.1) containing the fix. If updating is not possible, consider implementing WAF rules to filter malicious input.
Other vulnerabilities in IBM Aspera Faspex 5
See all- CVE-2026-14959Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via shell command injection.
- CVE-2026-14958Critical
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 allow a remote authenticated attacker to execute arbitrary code via unquoted shell interpolation.
- CVE-2022-47986CriticalActively exploited
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2.
- CVE-2026-14996High
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
- CVE-2025-36229Low
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 allow authenticated users to enumerate package identifiers, leading to disclosure of sensitive data information. The vulnerability enables information leakage through identifier guessing.
- CVE-2025-36228Low
IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1 may have inconsistent permissions between the user interface and backend API, allowing users to access features that appeared disabled. This could lead to misuse.
- CVE-2025-36171Medium
IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.
Original NVD description (English source)
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS