IBM Content Navigator vulnerabilities

40 CVEs affecting IBM Content Navigator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1243, published 2026-04-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1364, published 2018-01-29. High severity, CVSS 8.2. EPSS: 2.4% chance of exploitation in the next 30 days. IBM Content Navigator 2.0 and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive…
CVE-2019-4034, published 2019-03-14. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Content Navigator 3.0CD is could allow an attacker to execute arbitrary code on a user's workstation. When editing an executable file in ICN with Edit service, it will be executed on the user's…
CVE-2020-4934, published 2021-02-02. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view…
CVE-2013-5462, published 2013-12-19. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. IBM/ECMClient/configure/explodedformat/navigator/header.jsp in IBM Content Navigator 2.0.0, 2.0.1 before 2.0.1.2-ICN-FP002, and 2.0.2 before 2.0.2.1-ICN-FP001 allows remote attackers to conduct…
CVE-2014-0874, published 2014-02-28. Low severity, CVSS 3.5. EPSS: 1.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.x before 2.0.2.2-ICN-FP002 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter.
CVE-2020-4309, published 2020-03-24. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Content Navigator 3.0CD could disclose sensitive information to an unauthenticated user which could be used to aid in further attacks against the system. IBM X-Force ID: 177080.
CVE-2020-4757, published 2020-12-21. Medium severity, CVSS 6.4. EPSS: 1.3% chance of exploitation in the next 30 days. IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2020-4687, published 2020-08-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.7 and 3.0.8 could allow an authenticated user to view cached content of another user that they should not have access to. IBM X-Force ID: 186679.
CVE-2021-29714, published 2021-08-09. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. IBM X-Force ID: 200968.
CVE-2019-4741, published 2020-02-12. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to…

Latest

CVE-2026-1243, published 2026-04-02. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering…
CVE-2025-27906, published 2025-10-14. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.11, 3.0.15, 3.1.0, and 3.2.0 could expose the directory listing of the application upon using an application URL. Application files and folders are visible in the browser to…
CVE-2024-51475, published 2025-05-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser…
CVE-2024-56341, published 2025-04-02. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering…
CVE-2023-35896, published 2023-11-03. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to…
CVE-2023-40684, published 2023-10-04. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2022-43581, published 2022-12-07. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization and could allow an authenticated user to…
CVE-2021-20550, published 2021-04-27. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2021-20549, published 2021-04-27. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Content Navigator 3.0.CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…