Description
Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.
References (4)
Core 4
Core References
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21988726
Not Applicable vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/92471
Broken Link vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451
Scores
CVSS v3
2.7
EPSS
0.0091
EPSS Percentile
56.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (8)
ibm/forms_experience_builder
8.5.0.0
ibm/forms_experience_builder
8.5.1.0
ibm/forms_experience_builder
8.5.1.1
ibm/forms_experience_builder
8.6.0.0
ibm/forms_experience_builder
8.6.1
ibm/forms_experience_builder
8.6.1.1
ibm/forms_experience_builder
8.6.2
ibm/forms_experience_builder
8.6.2.1
Published
Sep 01, 2016
Tracked Since
Feb 18, 2026