CVE-2025-27897
Received Received - Intake

IBM Db2 Recovery Expert XSS Vulnerability in Web UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description
IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2025-27897
EUVD
EUVD-2025-211063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2. An unauthenticated attacker can inject malicious JavaScript into the Web UI, which could alter functionality and potentially steal user credentials during a trusted session.

Detection Guidance

This vulnerability is specific to IBM Db2 Recovery Expert's Web UI and requires manual inspection of web traffic or UI behavior. No standard commands are available for detection. Monitor for unusual JavaScript execution or UI alterations in the Web UI.

Impact Analysis

An attacker could exploit this to run arbitrary scripts in your browser, steal session cookies, or trick you into revealing sensitive information like login credentials. This could lead to unauthorized access to your Db2 Recovery Expert environment.

Compliance Impact

This vulnerability could lead to credential theft and unauthorized access, which may violate data protection requirements under GDPR and HIPAA. Organizations using this software may face compliance risks if exploited.

Mitigation Strategies

Apply the latest IBM Db2 Recovery Expert patch or update to version 5.5 IF 3 or later. Restrict access to the Web UI to trusted networks or users. Implement input validation for Web UI fields to prevent XSS payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-27897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart