CVE-2025-2670

IBM OpenPages 9.0 is affected by CVE-2025-2670 due to insufficient access control on certain REST endpoints related to the workflow feature. An authenticated user can disclose sensitive workflow configuration and internal state. The issue has a CVSS v3.1 base score of 4.3 (Medium) with Network at...

CVE-2025-36082

CVE-2025-36082 affects IBM OpenPages 9.0 and 9.1, where web page cache can be stored locally and read by another user. Root cause: insecure caching behavior allowing sensitive data to linger in local caches. Impact: information disclosure on shared systems. Remediation: IBM released fixes to enfo...

CVE-2025-36223

IBM OpenPages versions 9.0 and 9.1 are affected by a Host header injection vulnerability (CVE-2025-36223) caused by improper validation of HOST header input. The issue could enable attacks such as cross-site scripting, cache poisoning, or session hijacking. Public details across multiple sources ...

CVE-2025-36121

IBM OpenPages 9.0 and 9.1 are affected by an HTML injection (XSS) vulnerability in a specific URL endpoint. A remotely authenticated attacker could inject malicious HTML that executes in the victim’s browser within the hosting site's security context. CVSS v3.1 base score is 5.4 (medium) with net...

CVE-2025-33110

CVE-2025-33110 affects IBM OpenPages 9.1 and 9.0 with Watson. The issue is HTML injection in the UI, allowing a remote attacker to inject HTML that runs in the victim’s browser within the hosting site’s security context. IBM’s bulletin confirms affected versions and lists fixes: 9.1.2 for 9.1 and...

CVE-2025-27368

CVE-2025-27368 affects IBM OpenPages 9.0 and 9.1, where insufficient access control on certain OpenPages REST endpoints allows an authenticated user to view system metadata beyond their authorization. The issue stems from weaker than expected REST endpoint security, enabling information disclosur...