CVE-2025-31994— HCL Unica Campaign is vulnerable to Reflected Cross-Site Scripting (XSS)
Quick assessment
Affected
HCL Software Unica Campaign
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Unica Campaign是印度HCL公司的一个营销活动管理解决方案。 HCL Unica Campaign 12.1.10版本存在安全漏洞，该漏洞源于HTTP请求中恶意脚本注入，可能导致反射型跨站脚本攻击。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-31994
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL Unica Campaign is vulnerable to Reflected Cross-Site Scripting (XSS)
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then reflected unsafely in the server's immediate response to the victim's browser, executing the script as if it originated from the trusted website.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Unica Campaign 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Unica Campaign是印度HCL公司的一个营销活动管理解决方案。 HCL Unica Campaign 12.1.10版本存在安全漏洞，该漏洞源于HTTP请求中恶意脚本注入，可能导致反射型跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL Software | Unica Campaign | <= 12.1.10 | - |
|
II. Public POCs for CVE-2025-31994
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-31994
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-31994 (1)
Same Patch Batch · HCL Software · 2025-10-13 · 3 CVEs total
| CVE-2025-31996 | 5.3 MEDIUM | Unprotected files are impacting HCL Unica Platform |
| CVE-2025-31995 | 3.5 LOW | HCL Unica MaxAI Workbench is vulnerable to improper input validation |
IV. Related Vulnerabilities
Same vendor: HCL Software
-
CVE-2026-21833
HCL AION is susceptible to a Missing "Content-Security-Polic -
CVE-2025-31980
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-67172
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-67171
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-67106
HCL BigFix Service Management is affected by multiple securi
Same weakness: CWE-79
-
CVE-2026-97652
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting v -
CVE-2026-85492
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site S -
CVE-2026-87920
W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site -
CVE-2026-59673
Multiple vulnerabilities in the Repasat application -
CVE-2026-59672
Multiple vulnerabilities in the Repasat application
V. Comments for CVE-2025-31994
No comments yet