CVE-2025-1826

mediumpriority · track · 0EPSS 0.002 · 7 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.18% (7th) EPSS

CVSS 5.4 · medium

Is it mine?

19 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_it

EPSS · scored 2026-10-23

IBM Engineering Requirements Management DOORS Next (IBM Jazz Foundation 7.0.2 to 7.0.2 iFix034, 7.0.3 to 7.0.3 iFix016, and 7.1.0 to 7.1.0 iFix004) is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users on the host network to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedJazz Foundationcisa_csaf_it
Fixed in 7.0.2 iFix035.
https://www.ibm.com/support/pages/node/7247292

cvss

Technical severity, 0–10. One row per scoring source.

5.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · CISA US

v3.15.4mediumAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:Nsecondary · psirt@us.ibm.com USexploitability 2.3 · impact 2.7

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79USCWE-79US

affected products (19)

Products and version ranges known to be affected.

IBM Jazz Foundation 7.0.2 iFix035all versionsfixedcisa_csaf_itUS
IBM Jazz Foundation 7.0.3 iFix017all versionsfixedcisa_csaf_itUS
IBM Jazz Foundation 7.1.0 iFix005all versionsfixedcisa_csaf_itUS
IBM Jazz Foundation >=7.0.2|<7.0.2 iFix035all versionscisa_csaf_itUS
IBM Jazz Foundation >=7.0.3|<7.0.3 iFix017all versionscisa_csaf_itUS
IBM Jazz Foundation >=7.1.0|<7.1.0 iFix005all versionscisa_csaf_itUS
IBM Jazz Foundationall versionsfixedcisa_csaf_itUS
IBM Jazz Foundation7.0.2| → 7.0.2 iFix035cisa_csaf_itUS
IBM Jazz Foundation7.0.3| → 7.0.3 iFix017cisa_csaf_itUS
IBM Jazz Foundation7.1.0| → 7.1.0 iFix005cisa_csaf_itUS
IBM Jazz Foundation≤ 7.0.2 ≤7.0.2 iFix034enisa_euvdEU
IBM Jazz Foundation≤ 7.0.3 ≤7.0.3 iFix016enisa_euvdEU
IBM Jazz Foundation≤ 7.1.0 ≤7.1.0 iFix004enisa_euvdEU
IBM Corp. IBM Engineering Requirements Management DOORS Next7.0.2 → 7.0.2 iFix034fstec_bduRU
IBM Corp. IBM Engineering Requirements Management DOORS Next7.0.3 → 7.0.3 iFix016fstec_bduRU
IBM Corp. IBM Engineering Requirements Management DOORS Next7.1.0 → 7.1.0 iFix004fstec_bduRU
ibm jazz foundation= 7.0.2nvdUScpe:2.3:a:ibm:jazz_foundation:*:*:*:*:*:*:*:*
ibm jazz foundation= 7.0.3nvdUScpe:2.3:a:ibm:jazz_foundation:*:*:*:*:*:*:*:*
ibm jazz foundation= 7.1.0nvdUScpe:2.3:a:ibm:jazz_foundation:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

VA-25-297-01IBM DOORS Next Generation multiple vulnerabilities2025-10-22csaf · cisa_csaf_itUS
IBM Engineering Requirements Management DOORS contains multiple vulnerabilities that require authentication. These vulnerabilities include the ability to cause an application denial of service and JavaScript execution in the victim's browser through stored cross site scripting.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_it nvd NVD CVE.org MITRE

published 2025-10-07modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan