CVE-2025-36016

IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

• CWE-601

• https://www.ibm.com/support/pages/node/7237502Vendor Advisory

Published

Jun 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-36009IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Se…6.5
• CVE-2025-3601An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2025-36010IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow a…7.5
• CVE-2025-36011IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 doe…4.3
• CVE-2025-36014IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vu…6.7
• CVE-2025-36015IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controll…6.5
• CVE-2025-36017IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controll…6.5
• CVE-2025-36018IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulne…6.5
• CVE-2025-36019IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulne…6.1
• CVE-2025-3602Liferay Portal 7.4.0 through 7.4.3.97, and Liferay DXP 2023.…7.5
• CVE-2025-36020IBM Guardium Data Protection could allow a remote attacker t…7.5
• CVE-2025-36023IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 …6.5