PT-2025-40022 · Ibm · Ibm Planning Analytics Local

Published 2025-09-30 · Updated 2025-10-01 · CVE-2025-36132

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local versions 2.0.0 through 2.0.106 IBM Planning Analytics Local versions 2.1.0 through 2.1.13

Description An authenticated user can embed arbitrary JavaScript code in the Web UI, potentially altering intended functionality and leading to credentials disclosure within a trusted session. The issue involves cross-site scripting.

Recommendations Update IBM Planning Analytics Local to a version later than 2.0.106 Update IBM Planning Analytics Local to a version later than 2.1.13

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-16311

CVE-2025-36132

Affected Products

Ibm Planning Analytics Local

References · 7

• https://osv.dev/vulnerability/CVE-2025-36132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36132 · Security Note
• https://bdu.fstec.ru/vul/2025-16311 · Security Note
• https://ibm.com/support/pages/node/7246602 · Patch, Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1973194579135352939 · Twitter Post
• https://twitter.com/CVEnew/status/1973113270296097098 · Twitter Post
• https://t.me/CVEtracker/33760 · Telegram Post