CVE-2025-27897
6.1MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session to steal credentials or modify web UI behavior. To exploit this, an attacker needs network access to the web interface and must trick an authenticated user into interacting with a malicious payload.
Root cause
Improper neutralization of user-supplied input allows reflected or stored script injection into the Web UI.
Affected systems
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade to the vendor-provided patch referenced in IBM advisory 7290893. If patching cannot occur immediately, restrict network access to the Db2 Recovery Expert Web UI to trusted administrative networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.