CVE-2025-36116
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- EPSS probability
- 0.16%
- CWE
- CWE-1385
- Published
- 2025-07-23
- Last modified
- 2026-03-13
Affected products
- IBM Db2 Mirror for i
Weakness type
Related vulnerabilities
- CVE-2026-88061 — career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution
- CVE-2026-85183 — Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- CVE-2026-15580 — PassPortal browser extension: vault token disclosure via unvalidated postMessage
- CVE-2026-59950 — MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- CVE-2026-57111 — Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
- CVE-2026-59804 — Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
- CVE-2026-10054 — In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged...
- CVE-2026-44211 — Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability