← Back

CVE-2025-62320

nvd nist
Published: Mar 17, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

Affected (18)

Hcltech
9 products
Unica
Unica Audience Central
Unica Campaign
Unica Centralised Offer Management
Unica Contact Central
Unica Interact
Unica Journey
Unica Plan
Unica Segment Central
Configuration A
18 vulnerable
Vulnerable SoftwareAffected Versions
Hcltech
Unica
Before 12.1.11
Unica
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Audience Central
Before 12.1.11
Unica Audience Central
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Campaign
Before 12.1.11
Unica Campaign
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Centralised Offer Management
Before 12.1.11
Unica Centralised Offer Management
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Contact Central
Before 12.1.11
Unica Contact Central
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Interact
Before 12.1.11
Unica Interact
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Journey
Before 12.1.11
Unica Journey
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Plan
Before 12.1.11
Unica Plan
From 25.1.0 to 25.1.1.0.1
Hcltech
Unica Segment Central
Before 12.1.11
Unica Segment Central
From 25.1.0 to 25.1.1.0.1

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: psirt@hcl.com
PatchVendor Advisory

Timeline

No history available yet.