CVE-2025-36148 is a CWE-79 cross-site scripting vulnerability affecting IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.15. The vulnerability arises from improper neutralization of input during web page generation, enabling unauthenticated attackers to embed arbitrary JavaScript code in the web UI. This can alter intended functionality and potentially disclose credentials within a trusted session. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity. No vendor advisory or patch is currently available, and the product is not a cloud service.

Successful exploitation can lead to arbitrary JavaScript execution in the context of the affected web application, potentially resulting in credential disclosure and altered application behavior within a trusted session. The impact is limited to confidentiality and integrity with no availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected versions and applying web application firewall rules to detect and block suspicious input patterns related to XSS. Monitor vendor communications for updates on patches or official mitigations.