CVE-2025-36299
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code, which could be used in further attacks against the system.
Risk Assessment
Exposure of confidential data in source code may facilitate further attacks and privilege escalation.
Recommendation
Update IBM Planning Analytics Local to the latest version and remove sensitive information from source code.
Other vulnerabilities in IBM Planning Analytics Local
See all- CVE-2026-10545High
IBM Planning Analytics Local versions 2.1.0 through 2.1.21 are vulnerable to an open redirect. An attacker can redirect users to arbitrary external websites via a crafted URL. If used in SSO flows, this could expose session tokens and allow session hijacking.
- CVE-2025-36357High
IBM Planning Analytics Local versions 2.1.0 through 2.1.14 allow a remote authenticated user to traverse directories on the system. An attacker can send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files.
Original NVD description (English source)
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS