CVE-2025-36121: IBM OpenPages · Basic XSS
Affects IBM OpenPagesSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| IBM OpenPages | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-36121 effectively, European organizations should implement a multi-layered approach beyond generic advice: 1) Apply any available IBM patches or updates promptly once released; monitor IBM security advisories closely. 2) Enforce strict input validation and output encoding on all user-supplied data within OpenPages, particularly in fields that render HTML content. 3) Restrict user privileges to the minimum necessary, limiting the ability of authenticated users to inject or modify content that is rendered by others. 4) Implement Content Security Policy (CSP) headers to reduce the impact of injected scripts by restricting sources of executable code. 5) Conduct regular security assessments and penetration tests focusing on web application inputs and user roles within OpenPages. 6) Educate users about the risks of interacting with suspicious content and encourage reporting of unusual behavior. 7) Monitor logs for unusual input patterns or repeated attempts to inject HTML or scripts. 8) Consider deploying web application firewalls (WAFs) with rules tuned to detect and block XSS payloads targeting OpenPages. These targeted measures will reduce the attack surface and limit the potential impact of exploitation.
Description
IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.