← Vulnerability feed

Vulnerability record · CVE-2025-36027 · published 28 June 2025

CVE-2025-36027: Ibm datacap clickjacking vulnerability

Ibm · Datacap

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.

5.4 CVSS 3.1 Medium EPSS 0.22% · top 89.1% CWE-1021 · Clickjacking
5.4CVSS 3.1 base score
0.22%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7238443 Vendor Advisory

Track CVE-2025-36027 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-39736Ibm datacap vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOS…EPSS 0.37%8.8CVE-2020-4902Ibm datacap navigator sql injection vulnerabilityIBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. A remote attacker could send specially crafted SQL state…EPSS 0.97%7.5CVE-2026-8636Ibm datacap vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic…EPSS 0.20%7.5CVE-2024-39731Ibm datacap broken cryptographic algorithm vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp…EPSS 0.28%7.5CVE-2024-39732Ibm datacap cleartext storage of sensitive data vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious…EPSS 0.19%6.1CVE-2026-8059Ibm datacap cross-site scripting vulnerabilityIBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allow…EPSS 0.24%5.5CVE-2024-39733Ibm datacap insufficiently protected credentials vulnerabilityIBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Forc…EPSS 0.14%5.4CVE-2024-39730Ibm datacap vulnerabilityIBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to vi…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2025-36027), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.