CVE-2025-36230Medium· 5.4▾ SunlitIBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
aspera_faspex >= 5.0.0, < 5.0.14.2Upgrade past the affected range:
aspera_faspex 5.0.14.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-36228Low· 3.8IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.
CVE-2025-36229Low· 3.1IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
CVE-2025-66486Medium· 4.8IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection
CVE-2025-36321Medium· 5.7IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection
CVE-2026-12751Medium· 5.4IBM Cloud Pak for Business Automation is vulnerable to HTML injection
CVE-2026-84842High· 8.1IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component