IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting (XSS) vulnerability. This occurs because user-supplied input is not properly sanitized or HTML-encoded before being stored and rendered. An authenticated attacker could inject malicious JavaScript payloads that execute when other users view affected pages.