CVE-2026-1243
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
IBM Content Navigator versions 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. An authenticated user can embed arbitrary JavaScript in the Web UI, altering functionality and potentially leading to credential disclosure within a trusted session.
Risk Assessment
Potential session hijacking, credential theft, and UI manipulation. The vulnerability requires authentication but can be exploited by a malicious insider.
Recommendation
Apply available IBM fixes for Content Navigator or update to a non-vulnerable version. Implement CSP headers and input validation.
Other vulnerabilities in IBM Content Navigator
Original NVD description (English source)
IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS