CVE-2025-36075 · Vendor
NO FIX YET
IBM Safer Payments versions 6.4.0.00 through 6.8.0.00 fail to validate user input properly. An authenticated user can send a set of API requests to decrypt sensitive information.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments of IBM Safer Payments in the listed version ranges are exposed. The attacker needs a valid user account on the application, so teams that restrict accounts to trusted staff have less exposure. unknown whether specific configurations change exposure.
Not affected if unaffected-version
Who cares ibm-safer-payments, payments, self-hosted
No fix yet, per the sources.
IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.