CVE-2025-36398

MediumCVSS 5.4/10Last modified Sep 29, 2026

Description

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Sep 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-36404.3A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as CVE-2025-364075.5IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations.CVE-2025-364086.4IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript CVE-2025-364095.4IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code i CVE-2025-36418.8A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only avai CVE-2025-364104.3IBM ApplinX 11.1 could allow an authenticated user to perform unauthorized administrative actions on the server due to server-side enforceme CVE-2025-364113.5IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tra CVE-2025-364189.8IBM ApplinX 11.1 is vulnerable due to a privilege escalation vulnerability due to improper verification of JWT tokens. An attacker may be ab CVE-2025-364195.3IBM ApplinX 11.1 could disclose sensitive information about server architecture that could aid in further attacks against the system.CVE-2025-36428.8A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only avai CVE-2025-364215.9IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain CVE-2025-364224.3IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 IBM InfoSphere DataStage Flow Designer is vulnerable to cross-site request forge