← Back

CVE-2026-21825

nvd nist
Published: Jun 5, 2026Modified: Jun 10, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: psirt@hcl.com (Secondary)

Description

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.

Affected (67)

Hcltech
2 products
Digital Experience Compose
Digital Experience
Configuration A
12 vulnerable
Vulnerable SoftwareAffected Versions
Hcltech
Digital Experience Compose
Version 9.5
Digital Experience Compose
Version 9.5 cf224
Digital Experience Compose
Version 9.5 cf225
Digital Experience Compose
Version 9.5 cf226
Digital Experience Compose
Version 9.5 cf227
Digital Experience Compose
Version 9.5 cf228
Digital Experience Compose
Version 9.5 cf229
Digital Experience Compose
Version 9.5 cf230
Digital Experience Compose
Version 9.5 cf231
Digital Experience Compose
Version 9.5 cf232
Digital Experience Compose
Version 9.5 cf233
Digital Experience Compose
Version 9.5 cf234
Configuration B
55 vulnerable
Vulnerable SoftwareAffected Versions
Hcltech
Digital Experience
Version 9.5
Digital Experience
Version 9.5 cf171
Digital Experience
Version 9.5 cf172
Digital Experience
Version 9.5 cf173
Digital Experience
Version 9.5 cf17
Digital Experience
Version 9.5 cf181
Digital Experience
Version 9.5 cf182
Digital Experience
Version 9.5 cf183
Digital Experience
Version 9.5 cf184
Digital Experience
Version 9.5 cf18
Digital Experience
Version 9.5 cf191
Digital Experience
Version 9.5 cf192
Digital Experience
Version 9.5 cf193
Digital Experience
Version 9.5 cf194
Digital Experience
Version 9.5 cf195
Digital Experience
Version 9.5 cf196
Digital Experience
Version 9.5 cf197
Digital Experience
Version 9.5 cf198
Digital Experience
Version 9.5 cf199
Digital Experience
Version 9.5 cf19
Digital Experience
Version 9.5 cf200
Digital Experience
Version 9.5 cf201
Digital Experience
Version 9.5 cf202
Digital Experience
Version 9.5 cf203
Digital Experience
Version 9.5 cf204
Digital Experience
Version 9.5 cf205
Digital Experience
Version 9.5 cf206
Digital Experience
Version 9.5 cf207
Digital Experience
Version 9.5 cf208
Digital Experience
Version 9.5 cf209
Digital Experience
Version 9.5 cf210
Digital Experience
Version 9.5 cf211
Digital Experience
Version 9.5 cf212
Digital Experience
Version 9.5 cf213
Digital Experience
Version 9.5 cf214
Digital Experience
Version 9.5 cf215
Digital Experience
Version 9.5 cf216
Digital Experience
Version 9.5 cf217
Digital Experience
Version 9.5 cf218
Digital Experience
Version 9.5 cf219
Digital Experience
Version 9.5 cf220
Digital Experience
Version 9.5 cf221
Digital Experience
Version 9.5 cf222
Digital Experience
Version 9.5 cf223
Digital Experience
Version 9.5 cf224
Digital Experience
Version 9.5 cf225
Digital Experience
Version 9.5 cf226
Digital Experience
Version 9.5 cf227
Digital Experience
Version 9.5 cf228
Digital Experience
Version 9.5 cf229
Digital Experience
Version 9.5 cf230
Digital Experience
Version 9.5 cf231
Digital Experience
Version 9.5 cf232
Digital Experience
Version 9.5 cf233
Digital Experience
Version 9.5 cf234

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: psirt@hcl.com
Vendor Advisory

Timeline

No history available yet.