CVE-2025-12635Medium· 5.4▾ SunlitIBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vuln…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
websphere_application_server >= 8.5, < 8.5.5.29websphere_application_server >= 9.0, < 9.0.5.27websphere_application_server >= 17.0.0.3, < 26.0.0.1Upgrade past the affected range:
websphere_application_server 26.0.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94402Medium· 6.1IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
CVE-2023-38375Medium· 6.1IBM Cloud Pak System Cross-Site Scripting
CVE-2026-3295High· 7.4IBM Cloud Pak System Cross-Site Scripting
CVE-2026-4413Medium· 6.1IBM Concert Software Cross-Site Scripting
CVE-2026-4410Medium· 4.8IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted …
CVE-2026-53711Medium· 5.1MCP Context Forge provides an MCP Admin UI for managing gateway resources