Live › vulnerability › CVE-2026-3295
Go to dashboardIBM Cloud Pak System 2.3.6.0 and 2.3.6.1 do not sanitize or encode user input before storing and rendering it in the web app. An authenticated attacker can save JavaScript that runs in the browser of anyone who later views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 where users can enter data that is stored and shown in the web interface. Exposure depends on who holds accounts on the appliance, since the attacker must be authenticated. Installations on other versions are not listed as affected.
No product ranges from the sources yet.
2.3.6.0 or 2.3.6.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not properly sanitized or HTML‑encoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored Cross‑Site Scripting (Stored XSS).
This page as .md · .json · in your agent: get_signal("CVE-2026-3295")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.