CVE-2025-36147— IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.
Quick assessment
Affected
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the int
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-36147
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.
Source: CVE Program / CVE List V5
Vulnerability Description
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | Financial Transaction Manager for SWIFT Services for Multiplatforms | 3.2.4.0 ~ 3.2.4.16 |
cpe:2.3:a:ibm:financial_transaction_manager_for_swift_services_for_multiplatforms:3.2.4.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2025-36147
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-36147
请登录查看更多情报信息。
Other References for CVE-2025-36147 (1)
Same Patch Batch · IBM · 2026-09-18 · 31 CVEs total
| CVE-2026-10747 | 10.0 CRITICAL | IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message p |
| CVE-2025-15399 | 10.0 CRITICAL | Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool a |
| CVE-2026-10858 | 9.9 CRITICAL | IBM MQ for HPE NonStop is vulnerable to a denial of service attack |
| CVE-2026-11381 | 8.8 HIGH | IBM MQ for HPE NonStop is vulnerable to a denial of service issue |
| CVE-2026-11378 | 8.8 HIGH | IBM MQ queue manager is vulnerable to remote code execution |
| CVE-2026-11375 | 8.8 HIGH | IBM MQ queue manager is vulnerable to remote code execution |
| CVE-2026-10575 | 8.8 HIGH | IBM MQ queue manager is vulnerable to remote code execution |
| CVE-2025-14754 | 8.8 HIGH | IBM Cloud Pak for Data is vulnerable to OS command injection |
| CVE-2026-10027 | 8.1 HIGH | IBM MQ queue manager is vulnerable to unauthenticated remote code execution |
| CVE-2026-10853 | 7.5 HIGH | IBM MQ queue manager is vulnerable to remote code execution |
| CVE-2025-14753 | 7.5 HIGH | IBM Cloud Pak for Data is vulnerable to path traversal |
| CVE-2026-10751 | 7.5 HIGH | IBM MQ Java messaging is vulnerable to remote code execution |
| CVE-2026-10744 | 7.5 HIGH | IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validation |
| CVE-2026-10030 | 7.1 HIGH | IBM MQ Console is vulnerable to privilege escalation |
| CVE-2025-33141 | 6.5 MEDIUM | IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from bac |
| CVE-2026-1025 | 6.1 MEDIUM | Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool a |
| CVE-2026-1031 | 6.1 MEDIUM | Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool a |
| CVE-2026-1037 | 6.1 MEDIUM | Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool a |
| CVE-2025-36421 | 5.9 MEDIUM | Multiple vulnerabilities in IBM Controller |
| CVE-2025-33147 | 5.9 MEDIUM | IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities |
Showing top 20 of 31 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: IBM
-
CVE-2026-11537
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5 -
CVE-2026-11381
IBM MQ for HPE NonStop is vulnerable to a denial of service -
CVE-2026-11378
IBM MQ queue manager is vulnerable to remote code execution -
CVE-2026-11375
IBM MQ queue manager is vulnerable to remote code execution -
CVE-2026-10858
IBM MQ for HPE NonStop is vulnerable to a denial of service
Same weakness: CWE-79
-
CVE-2026-93432
Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and -
CVE-2026-91127
File Viewer: DOM XSS via unsafe hyperlink schemes in the leg -
CVE-2026-84992
md-editor-v3: XSS via fenced-code language rendering bypass -
CVE-2026-77616
Semantic MediaWiki affected by reflected XSS in `Special:Ask -
CVE-2026-77610
Semantic MediaWiki has a query debug output XSS (`DebugForma
V. Comments for CVE-2025-36147
No comments yet