{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1243","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","state":"PUBLISHED","assignerShortName":"ibm","dateReserved":"2026-01-20T18:45:11.903Z","datePublished":"2026-04-02T00:14:31.101Z","dateUpdated":"2026-04-02T13:49:12.514Z"},"containers":{"cna":{"providerMetadata":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-04-02T00:14:31.101Z"},"title":"IBM Content Navigator is affected by , a Cross-Site Scripting (XSS) vulnerability","affected":[{"vendor":"IBM","product":"Content Navigator","versions":[{"status":"affected","version":"3.0.15","lessThanOrEqual":"1.11.0","versionType":"semver"},{"status":"affected","version":"3.1.0"},{"status":"affected","version":"3.2.0"}],"cpes":["cpe:2.3:a:ibm:content_navigator:3.0.15:*:*:*:*:*:*:*","cpe:2.3:a:ibm:content_navigator:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:content_navigator:3.2.0:*:*:*:*:*:*:*"]}],"descriptions":[{"lang":"en","value":"IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.</p>"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7268006","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}],"solutions":[{"lang":"en","value":"Affected VersionsFixes3.0.15ICN 3.0.15 IF0093.1.0ICN 3.1.0 IF008 LA23.2.0ICN 3.2.0 IF004","supportingMedia":[{"type":"text/html","base64":false,"value":"<table><tbody><tr><td>Affected Versions</td><td>Fixes</td></tr><tr><td>3.0.15</td><td>ICN 3.0.15 IF009</td></tr><tr><td>3.1.0</td><td>ICN 3.1.0 IF008 LA2</td></tr><tr><td>3.2.0</td><td>ICN 3.2.0 IF004</td></tr></tbody></table>"}]}],"x_generator":{"engine":"ibm-cvegen"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-79","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-02T13:49:08.537768Z","id":"CVE-2026-1243","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-04-02T13:49:12.514Z"}}]}}