EUVD-2026-78901
GHSA-33wj-g5qc-mfvv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.
AnalysisAI
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21
IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to b
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21
Cloud Pak For Business Automation versions up to 24.0.0 is affected by cross-site scripting (xss) (CVSS 6.4).
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript in
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary J
Sensitive information disclosure in IBM Enterprise Records (a component of IBM Cloud Pak for Business Automation) allows
IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross
IBM Business Automation Workflow is vulnerable to cross-site scripting. Rated medium severity (CVSS 6.1), this vulnerabi
IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21
Cloud Pak For Business Automation versions up to 24.0.0 contains a vulnerability that allows attackers to an authenticat
IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today