High severity · published May 21, 2025
CVE-2025-2261
TIBCO BPM Enterprise XSS Vulnerability
7.0
CVSS
0.4%
EPSS
No
On KEV
Description
Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TB
TIBCO BPM Enterprise · TIBCO Software Inc
4.3 before 4 · source: vendor