CVE-2026-9870 · Vendor
NO FIX YET
IBM Cyber Fraud versions 1.0.0 through 1.1.0 have a cross-site scripting flaw in the web UI. An unauthenticated attacker can inject arbitrary JavaScript that alters the page and could lead to credential disclosure inside a trusted session.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running IBM Cyber Fraud versions 1.0.0 through 1.1.0 with the web UI exposed to users. The sources do not say which deployment configurations are affected or whether a setting limits exposure.
Who cares ibm-cyber-fraud, web-ui
Unknown from the sources.
No fix yet, per the sources.
IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.