CVE-2025-12635Medium· 5.4▾ SunlitIBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vuln…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
websphere_application_server >= 8.5, < 8.5.5.29websphere_application_server >= 9.0, < 9.0.5.27websphere_application_server >= 17.0.0.3, < 26.0.0.1Upgrade past the affected range:
websphere_application_server 26.0.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-15328High· 7.4IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.
CVE-2026-15064High· 8.7IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
CVE-2026-14981High· 7.5IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
CVE-2026-18872Critical· 9.3IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42)
CVE-2026-11538Low· 3.7IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.
CVE-2026-9176Medium· 6.7IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls