IBM OpenPages CVE-2025-36121

Exploitation requires the attacker to hold a valid authenticated OpenPages session (PR:L) with the ability to submit/store content that is rendered back to other users, and it requires a victim to subsequently view that injected HTML (UI:R) - it is not a drive-by unauthenticated attack. Limiting factors: valid credentials are mandatory, a second user must view the malicious content for impact to occur, and impact is confined to low confidentiality/integrity effects within the browser's site context (no availability or server-side code execution). Affected deployments are IBM OpenPages versions 9.0 and 9.1 specifically.

This is a genuinely moderate, not high, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) describes a network-reachable but authentication-gated (PR:L) and user-interaction-dependent (UI:R) HTML-injection flaw with only low confidentiality and integrity impact and no availability impact. All real-world exploitation signals point low: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public proof-of-concept was identified in the provided intelligence. The signals are consistent rather than conflicting - a low-severity web flaw requiring an authenticated session and a victim interaction, with no evidence of exploitation. The scope change (S:C) is the one factor that modestly elevates concern, reflecting that injected content executes in the browser security context of the hosting site and can affect other users/sessions. Net: a legitimate issue to patch in routine cycles, but not an emergency relative to higher-severity, actively exploited vulnerabilities.

A low-privileged but authenticated IBM OpenPages user stores malicious HTML in a field that is later rendered to other users. When a victim (e.g., a reviewer or administrator) views that content, the injected markup executes in their browser within the OpenPages site's security context, enabling UI manipulation or session-context actions. No public exploit code was identified; exploitation requires both valid credentials and a victim viewing the injected content (UI:R).