CVE-2025-36147 is a cross-site scripting vulnerability (CWE-79) affecting IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.16. The vulnerability arises from improper neutralization of input during web page generation, allowing unauthenticated attackers to embed arbitrary JavaScript code in the web UI. This can alter the intended functionality of the application and potentially lead to credential disclosure within a trusted session. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An unauthenticated attacker can exploit this vulnerability to inject malicious JavaScript into the web interface, potentially leading to the disclosure of user credentials within an active session. This compromises the confidentiality and integrity of user data in the affected application versions. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor IBM's advisories for updates. Until a fix is available, consider restricting access to the web UI to trusted users and environments to reduce exposure.