Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

IBM Engineering Workflow Management allows malicious scripts in UI

CVE-2025-33128 · published 4 months ago
Summary

IBM Engineering Workflow Management versions 7.0.3 and 7.1 have a security weakness that lets a trusted user inject malicious code into the application's user interface. This could potentially expose sensitive information like login credentials. To fix this, update to the latest version of the software.

Original advisory text
IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user t...
IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Sources
CVE-2025-33128 · NVD
Track software like this
Free during beta