7.4
High
CVE-2026-3295 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting
Description
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Cloud Pak System 2.3 | 2.3.6.0 → 2.3.6.1 | No fix stated |
Other CVEs of Cloud Pak System
The 40 CVEs of Cloud Pak System →
CVE-2023-38375
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting
6.1
Medium
CVE-2026-3161
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an…
5.9
Medium
CVE-2026-4418
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection
5.4
Medium
CVE-2026-13463
IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of…
7.5
High