cbcvebase.
CVE-2025-0917
published 2025-06-11

CVE-2025-0917: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This…

PriorityP420medium4.8CVSS 3.1
AVNACLPRHUIRSCCLILAN
EPSS
0.18%
7.5th percentile
IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected

12 ranges
VendorProductVersion rangeFixed in
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics——
ibmcognos_analytics11.2.0 – 11.2.4—
ibmcognos_analytics12.0.0 – 12.0.4—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.