IBM Application Gateway
Moderate fix1 remedy
cpe:2.3:a:ibm:application_gateway:*:*:*:*:*:*:*
Moderate fix1 remedy
- >= 23.10, <= 25.09
IBM Application Gateway HTML Injection Vulnerability
Vulnerability
Patched
A vulnerability allowing HTML injection has been identified in IBM Application Gateway versions 23.10 through 25.09. This issue enables remote attackers to inject malicious HTML code, which would be executed in the context of the victim's web browser, potentially leading to unauthorized actions on the hosting site.
Impact
Exploitation of this vulnerability allows for HTML injection, where injected code is executed in the context of the user's browser, potentially leading to cross-site scripting (XSS) scenarios.
Remediation
Users are encouraged to update to the latest version of IBM Application Gateway. For those using the container version, the latest version can be obtained by pulling from the IBM Container Registry. Instructions for this are available in the IBM Application Gateway documentation.
Added: Jan 20, 2026, 5:28 PM
Updated: Jan 20, 2026, 5:28 PM
Vulnerability Rating
Custom Algorithm
spread
1.0impact
1.7exploitability
5.2remediation
7.7relevance
2.2threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.