CVE-2025-36226
published 2026-03-10CVE-2025-36226: IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript…
medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | aspera_faspex | >= 5.0.0 < 5.0.15 | 5.0.15 |
| ibm | aspera_faspex_5 | 5.0.0 – 5.0.14.3 | — |
| msrc | cm1_openldap_2.4.57-2_on_cbl_mariner_1.0 | — | — |