CVE-2025-27895
6.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in an authenticated user's browser session and potentially steal credentials. Exploitation requires network access to the Web UI and a user to trigger the malicious payload.
Root cause
The Web UI improperly neutralizes user-supplied input before rendering it, causing a reflected or stored cross-site scripting vulnerability.
Affected systems
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade to the patched interim fix specified in IBM advisory node/7290893. As an interim mitigation, restrict network access to the Web UI to trusted internal networks and instruct operators not to follow untrusted links.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.