CVE-2025-27367

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM OpenPages with Watson 8.3 and 9.0

is vulnerable to improper input validation due to bypassing of client-side validation for the data types and requiredness of fields for GRC Objects when an authenticated user sends a specially crafted payload to the server allowing for data to be saved without storing the required fields.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-602

Affected software

Vendor	Product	Versions
IBM	OpenPages with Watson	8.3; 9.0

References

https://www.ibm.com/support/pages/node/7239155Patch, Vendor Advisory

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-273684.3IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certai CVE-2025-273694.3IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to information disclosure of sensitive information due to a weaker than expected CVE-2025-27379.8A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part CVE-2025-273706.9OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechan CVE-2025-273716.9In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, the CVE-2025-273745.3An issue was discovered in the Secure Boot component in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850, 10 CVE-2025-273775.3Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a CVE-2025-273789.8AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. W CVE-2025-273794.6A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary CVE-2025-27389.8A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been declared as critical. This vulnerability affects unk CVE-2025-273807.6HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbit CVE-2025-273877.4OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.