CVE-2025-3633 is a CWE-79 cross-site scripting vulnerability affecting multiple versions of IBM Cognos Analytics and IBM Cognos Transformer. The vulnerability enables remote attackers with limited privileges to inject malicious JavaScript code into the web user interface. This can lead to altered application behavior and possible credential disclosure within an authenticated session. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on IBM's future updates.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the affected IBM Cognos Analytics web interface. This may result in altered application functionality and potential disclosure of user credentials within a trusted session. The vulnerability requires the attacker to have some privileges and user interaction, limiting the ease of exploitation. There are no reported active exploits in the wild.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, limit access to affected versions and monitor for suspicious activity. Avoid granting unnecessary privileges to users to reduce exploitation risk. Do not rely on generic mitigations unless specifically recommended by IBM.