CVE-2025-62320— HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform
Quick assessment
Affected
HCL Sametime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Unica Platform是印度HCL公司的一个先进的企业自动化营销平台。无需人工操作即可处理日常营销任务并捕获最有效的潜在客户。 HCL Unica Platform存在安全漏洞，该漏洞源于未正确检查或清理用户输入，可能导致HTML注入攻击，造成用户浏览器与外部资源进行意外交互。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-62320
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform
Source: CVE Program / CVE List V5
Vulnerability Description
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Unica Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Unica Platform是印度HCL公司的一个先进的企业自动化营销平台。无需人工操作即可处理日常营销任务并捕获最有效的潜在客户。 HCL Unica Platform存在安全漏洞，该漏洞源于未正确检查或清理用户输入，可能导致HTML注入攻击，造成用户浏览器与外部资源进行意外交互。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-62320
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-62320
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-62320 (1)
IV. Related Vulnerabilities
Same product: Sametime
-
CVE-2025-31966
Boolean-Based SQL Injection in Multiple Unica Components -
CVE-2026-21791
HCL Sametime for Android is affected by sensitive informatio -
CVE-2023-50355
HCL Sametime is impacted by generation of error messages con -
CVE-2024-30124
HCL Sametime is impacted by insecure services -
CVE-2024-30122
HCL Sametime is impacted by misconfigured security related H
Same vendor: HCL
-
CVE-2025-62347
HCL iControl 输入验证错误漏洞 -
CVE-2025-59874
HCL Hive Telco Observability is affected by a Required dire -
CVE-2025-52606
HCL iControl was affected by Weak Input Validation vulnerabi -
CVE-2025-52608
HCL iControl was affected by Missing Cookie Attributes vuln -
CVE-2025-52609
HCL iControl was affected by Missing Security Headers vulner
Same weakness: CWE-79
-
CVE-2026-104473
YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and li -
CVE-2026-104470
YesWiki before 4.6.7 SSRF and XSS via Bazar valeur Action -
CVE-2026-104466
YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src -
CVE-2026-104465
YesWiki before 4.6.7 Reflected XSS via field Parameter in ma -
CVE-2026-104461
YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload i
V. Comments for CVE-2025-62320
No comments yet