CVE-2025-36148 is a cross-site scripting vulnerability (CWE-79) affecting IBM Financial Transaction Manager for SWIFT Services for Multiplatforms versions 3.2.4.0 through 3.2.4.15. The vulnerability arises from improper neutralization of input during web page generation, enabling unauthenticated attackers to embed arbitrary JavaScript code in the web UI. This can alter intended functionality and potentially disclose credentials within a trusted session. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with impact on confidentiality and integrity but no impact on availability. The vendor has not published a patch or official remediation at this time.

An attacker exploiting this vulnerability can inject malicious scripts into the web interface, which may lead to unauthorized disclosure of user credentials within an active session. This compromises confidentiality and integrity of the affected system's web UI interactions. There is no indication of impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider applying web application firewall (WAF) rules to detect and block XSS attempts targeting this product. Monitor vendor communications for updates on patches or official mitigations.