Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-55266— HCL Aftermarket DPC is affected by Session Fixation

Quick assessment

Affected
HCL Aftermarket DPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HCL Aftermarket DPC是印度HCL公司的一个数字化备件与售后服务管理平台。 HCL Aftermarket DPC存在安全漏洞，该漏洞源于会话固定，可能导致攻击者接管用户会话并进行未经授权的交易。

CVSS 5.9 · Medium EPSS 0.25% · P16
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-55266

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HCL Aftermarket DPC is affected by Session Fixation
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf of the user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Aftermarket DPC 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Aftermarket DPC是印度HCL公司的一个数字化备件与售后服务管理平台。 HCL Aftermarket DPC存在安全漏洞，该漏洞源于会话固定，可能导致攻击者接管用户会话并进行未经授权的交易。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
HCL Aftermarket DPC version 1.0.0 -

II. Public POCs for CVE-2025-55266

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-55266

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-55266 (1)

Same Patch Batch · HCL · 2026-03-26 · 17 CVEs total

CVE-2025-55262 8.3 HIGH HCL Aftermarket DPC is affected by SQL Injection
CVE-2025-55261 8.1 HIGH HCL Aftermarket DPC is affected by Missing Functional Level Access Control
CVE-2025-55263 7.3 HIGH HCL Aftermarket DPC is affected by Hardcoded Sensitive Data
CVE-2025-55265 6.5 MEDIUM HCL Aftermarket DPC is affected by File Discovery
CVE-2025-55267 5.7 MEDIUM HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability
CVE-2025-55264 5.5 MEDIUM HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change
CVE-2025-55273 4.3 MEDIUM HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability
CVE-2025-55268 4.3 MEDIUM HCL Aftermarket DPC is affected by Spamming Vulnerability
CVE-2025-55269 4.2 MEDIUM HCL Aftermarket DPC is affected by Weak Password Policy vulnerability
CVE-2025-55275 3.7 LOW HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability
CVE-2025-55270 3.5 LOW HCL Aftermarket DPC is affected by Improper Input Validation
CVE-2025-55272 3.1 LOW HCL Aftermarket DPC is affected by Banner Disclosure vulnerability
CVE-2025-55276 3.1 LOW HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability
CVE-2025-55271 3.1 LOW HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability
CVE-2025-55274 2.6 LOW HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability
CVE-2025-55277 2.6 LOW HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability

IV. Related Vulnerabilities

Same product: Aftermarket DPC
Same vendor: HCL
Same weakness: CWE-384

V. Comments for CVE-2025-55266

No comments yet

Leave a comment