Medium · 6.1 CVE-2025-27896 EUVD-2025-211064GHSA-x9cv-h294-g58f

IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

Published Oct 12, 2026 · Updated Oct 12, 2026 · Assigned by ibm

Vendor: IBM Product: DB2 Recovery Expert for Linux, UNIX and Windows Platform: Linux Platform: Windows

Description

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected products

Vendor	Product	Affected	Fixed
IBM	DB2 Recovery Expert for Linux, UNIX and Windows	5.5 IF 2	—

References

https://www.ibm.com/support/pages/node/7290893 vendor-advisory patch