5.4
Medium
CVE-2025-2895 IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to…
Description
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud Pak System 2.3 | 2.3.3.6 → latest | No fix stated |
Other CVEs of Cloud Pak System
The 40 CVEs of Cloud Pak System →
CVE-2023-38375
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting
6.1
Medium
CVE-2026-3161
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an…
5.9
Medium
CVE-2026-3295
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting
7.4
High
CVE-2026-4418
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection
5.4
Medium