CVE-2025-3633Medium· 5.4▾ SunlitIBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vulnerability allows a remote attacker to inject arbitrary JavaScript code into …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vulnerability allows a remote attacker to inject arbitrary JavaScript code into the web user interface, which may alter the intended functionality and could lead to the disclosure of credentials within a trusted session.
cognos_analytics >= 11.2.0, < 11.2.4cognos_analytics >= 12.0.0, < 12.0.4cognos_analytics >= 12.1.0, < 12.1.2cognos_analytics = 11.2.4cognos_analytics = 12.0.4cognos_transformer = 11.2.4cognos_transformer = 12.0cognos_transformer = 12.1.0Upgrade past the affected range:
cognos_analytics 12.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94402Medium· 6.1IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
CVE-2023-38375Medium· 6.1IBM Cloud Pak System Cross-Site Scripting
CVE-2026-3295High· 7.4IBM Cloud Pak System Cross-Site Scripting
CVE-2026-4413Medium· 6.1IBM Concert Software Cross-Site Scripting
CVE-2026-53711Medium· 5.1MCP Context Forge provides an MCP Admin UI for managing gateway resources
CVE-2026-93886High· 8.3IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.