Vulnerability · Published Jun 22, 2026 · Assigned by ibm

CVE-2025-33128IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed

Medium 5.4

In plain English

A medium-severity cross-site scripting in Engineering Workflow Management from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected products (as reported)

Vendor	Product	Versions
IBM	Engineering Workflow Management	7.0.3 – through 7.0.3 Interim Fix 0207.1.0 – through 7.1 Interim Fix 007

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://www.ibm.com/support/pages/node/7276116 vendor-advisory, patch