CVE-2025-27368

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond what the user is intended to view.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-273694.3IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to information disclosure of sensitive information due to a weaker than expected CVE-2025-27379.8A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been classified as critical. This affects an unknown part CVE-2025-273706.9OpenID Connect Core through 1.0 errata set 2 allows audience injection in certain situations. When the private_key_jwt authentication mechan CVE-2025-273716.9In certain IETF OAuth 2.0-related specifications, when the JSON Web Token Profile for OAuth 2.0 Client Authentication mechanism is used, the CVE-2025-273745.3An issue was discovered in the Secure Boot component in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850, 10 CVE-2025-273775.3Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a CVE-2025-273789.8AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. W CVE-2025-273794.6A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary CVE-2025-27389.8A vulnerability was found in PHPGurukul Old Age Home Management System 1.0. It has been declared as critical. This vulnerability affects unk CVE-2025-273807.6HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbit CVE-2025-273877.4OPPO Clone Phone uses a weak password WiFi hotspot to transfer files, resulting in Information disclosure.CVE-2025-273888.3Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.