CVE-2025-12635

🗓️ 08 Dec 2025 21:58:13Reported by ibmType

Cross-site scripting in IBM WebSphere App Server 8.5/9.0 and Liberty 17.0.0.3–25.0.0.12 via crafted URL redirect.

Reporter	Title	Published	Views	Family All 61
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to cross-site scripting due to IBM WebSphere Application Server Liberty (CVE-2025-12635)	14 Apr 202615:09	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of IBM WebSphere Application Server Liberty, CICS Transaction Gateway Desktop Edition and CICS Transaction Gateway for Multiplatforms are vulnerable to two security vulnerabilities.	9 Apr 202608:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty shipped with IBM Engineering Test Management are affected by cross-site scripting (CVE-2025-12635)	20 Apr 202606:41	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of IBM WebSphere Application Server, IBM Tivoli Network Manager (ITNM) IP Edition is affected by affected by cross-site scripting (CVE-2025-12635).	6 Mar 202605:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a cross-site scripting vulnerability (CVE-2025-12635)	17 Dec 202514:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by a cross-site scripting vulnerability (CVE-2025-12635)	17 Dec 202514:30	–	ibm
IBM Security Bulletins	Security Bulletin: Updating IBM WebSphere Liberty Profile in Identity Insight for security update	19 May 202614:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty (CVE-2025-14914, CVE-2025-12635)	25 Mar 202606:30	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM WebSphere Application (CVE-2025-12635) affects IBM PowerVM Novalink.	4 May 202605:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2025-12635)	24 Mar 202617:01	–	ibm

NVD

Vulners

Node

ibm websphere_application_serverRange8.5–8.5.5.29

ibm websphere_application_serverRange9.0–9.0.5.27

ibm websphere_application_serverRange17.0.0.3–26.0.0.1liberty

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:*"
    ],
    "product": "WebSphere Application Server",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "2.0.18",
        "status": "affected",
        "version": "9.0",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.5"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:ibm:websphere_application_server:17.0.0.3:*:*:*:liberty:*:*:*",
      "cpe:2.3:a:ibm:websphere_application_server:25.0.0.12:*:*:*:liberty:*:*:*"
    ],
    "product": "WebSphere Application Server Liberty",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "25.0.0.12",
        "status": "affected",
        "version": "17.0.0.3",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
ibm	www.ibm.com/support/pages/node/7254078

11 Dec 2025 00:01Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.4

EPSS0.00019

SSVC

CWE-79