CVE-2014-6091: IBM Curam Social Program Management

Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management (SPM) 6.0.4 before 6.0.4.5 iFix7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

Affected products

• IBM Curam Social Program Management: version 6.0.4.0 only; version 6.0.4.1 only; version 6.0.4.2 only; version 6.0.4.3 only; version 6.0.4.4 only; version 6.0.4.5 only

Published 2014-09-23. Last modified 2026-06-17.