CVE-2025-33128

EPSS 0.23%
Veröffentlicht 22.06.2026 13:20:14
Zuletzt bearbeitet 06.10.2026 22:10:00
Erkennungen
Login

IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed

IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 29 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update -

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix001

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix002

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix003

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix004

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix005

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix006

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix007

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix008

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix009

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix010

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix011

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix012

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix013

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix014

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix015

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix016

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix017

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix018

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix019

Ibm ≫ Engineering Workflow Management Version 7.0.3 Update ifix020

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update -

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update ifix001

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update ifix002

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update ifix003

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update ifix004

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update ifix005

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update ifix006

Ibm ≫ Engineering Workflow Management Version 7.1.0 Update ifix007

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.23%	0.14

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
IBM	5.4	2.3	2.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.ibm.com/support/pages/node/7276116

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-33128

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-33128

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-33128

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2025-33128