CVE-2025-55274— HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability
Quick assessment
Affected
HCL Aftermarket DPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Aftermarket DPC是印度HCL公司的一个数字化备件与售后服务管理平台。 HCL Aftermarket DPC存在安全漏洞，该漏洞源于跨域资源共享配置不当，可能导致敏感用户信息泄露、API未经授权访问以及数据篡改或泄露，攻击者可利用此配置不当窃取敏感数据或以合法用户身份执行操作。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-55274
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to attackers, unauthorized access to APIs, and possible data manipulation or leakage. If an attacker to exploit CORS misconfiguration, they could steal sensitive data, perform actions on behalf of a legitimate user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过度许可的跨域白名单
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Aftermarket DPC 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Aftermarket DPC是印度HCL公司的一个数字化备件与售后服务管理平台。 HCL Aftermarket DPC存在安全漏洞，该漏洞源于跨域资源共享配置不当，可能导致敏感用户信息泄露、API未经授权访问以及数据篡改或泄露，攻击者可利用此配置不当窃取敏感数据或以合法用户身份执行操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL | Aftermarket DPC | version 1.0.0 | - |
|
II. Public POCs for CVE-2025-55274
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-55274
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-55274 (1)
Same Patch Batch · HCL · 2026-03-26 · 17 CVEs total
| CVE-2025-55262 | 8.3 HIGH | HCL Aftermarket DPC is affected by SQL Injection |
| CVE-2025-55261 | 8.1 HIGH | HCL Aftermarket DPC is affected by Missing Functional Level Access Control |
| CVE-2025-55263 | 7.3 HIGH | HCL Aftermarket DPC is affected by Hardcoded Sensitive Data |
| CVE-2025-55265 | 6.5 MEDIUM | HCL Aftermarket DPC is affected by File Discovery |
| CVE-2025-55266 | 5.9 MEDIUM | HCL Aftermarket DPC is affected by Session Fixation |
| CVE-2025-55267 | 5.7 MEDIUM | HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability |
| CVE-2025-55264 | 5.5 MEDIUM | HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change |
| CVE-2025-55273 | 4.3 MEDIUM | HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability |
| CVE-2025-55268 | 4.3 MEDIUM | HCL Aftermarket DPC is affected by Spamming Vulnerability |
| CVE-2025-55269 | 4.2 MEDIUM | HCL Aftermarket DPC is affected by Weak Password Policy vulnerability |
| CVE-2025-55275 | 3.7 LOW | HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability |
| CVE-2025-55270 | 3.5 LOW | HCL Aftermarket DPC is affected by Improper Input Validation |
| CVE-2025-55272 | 3.1 LOW | HCL Aftermarket DPC is affected by Banner Disclosure vulnerability |
| CVE-2025-55276 | 3.1 LOW | HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability |
| CVE-2025-55271 | 3.1 LOW | HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability |
| CVE-2025-55277 | 2.6 LOW | HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability |
IV. Related Vulnerabilities
Same product: Aftermarket DPC
-
CVE-2025-55261
HCL Aftermarket DPC is affected by Missing Functional Level -
CVE-2025-55262
HCL Aftermarket DPC is affected by SQL Injection -
CVE-2025-55263
HCL Aftermarket DPC is affected by Hardcoded Sensitive Data -
CVE-2025-55264
HCL Aftermarket DPC is affected by Failure to Invalidate Ses -
CVE-2025-55265
HCL Aftermarket DPC is affected by File Discovery
Same vendor: HCL
-
CVE-2025-62347
HCL iControl 输入验证错误漏洞 -
CVE-2025-59874
HCL Hive Telco Observability is affected by a Required dire -
CVE-2025-52606
HCL iControl was affected by Weak Input Validation vulnerabi -
CVE-2025-52608
HCL iControl was affected by Missing Cookie Attributes vuln -
CVE-2025-52609
HCL iControl was affected by Missing Security Headers vulner
Same weakness: CWE-942
-
CVE-2026-66070
RabbitMQ: CORS * reflects Origin with Allow-Credentials -
CVE-2026-90882
Reflected arbitrary origins with credentials, allowing cross -
CVE-2026-56595
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-92359
ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_ -
CVE-2026-62895
Azure Arc SQL Server Extension Elevation of Privilege Vulner
V. Comments for CVE-2025-55274
No comments yet