Cross-Site Scripting Vulnerability in IBM Concert for Z Hub Framework
CVE-2025-36019

6.1MEDIUM

Key Information:

Vendor

IBM
Status
Concert
Vendor
CVE Published:
17 February 2026

What is CVE-2025-36019?

The IBM Concert application versions 1.0.0 through 2.1.0 contain a cross-site scripting vulnerability within the Z hub framework. This issue potentially allows an unauthenticated attacker to inject arbitrary JavaScript into the Web UI, compromising the application's intended functionality. Exploiting this vulnerability could lead to the disclosure of sensitive credentials during a trusted session, highlighting the importance of immediate patching to safeguard against such security risks.

Affected Version(s)

Concert 1.0.0 <= 2.1.0

References

https://www.ibm.com/support/pages/node/7260162
vendor-advisorypatch

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.