Skip to content
OpenAdvisories
Medium · 5.4 CVE-2025-36121 EUVD-2025-36194GHSA-hg9g-9mr2-cpv6

HTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages Application

Published Oct 27, 2025 · Updated Oct 27, 2025 · Assigned by ibm

Vendor: IBM Product: OpenPages

Description

IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

Affected products

VendorProductAffectedFixed
IBM OpenPages 9.1, 9.0 —

References