CVE-2026-67075— HCL Digital Experience is affected by improper input sanitation
Quick assessment
Affected
HCLSoftware Digital Experience
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Digital Experience 存在输入清理不当的问题。这可能导致 HTML 注入攻击，进而被利用来实施来自可信域名的内容欺骗。请应用 HCL Digital Experience 9.5 CF238 或更高版本以解决此问题。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-67075
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL Digital Experience is affected by improper input sanitation
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCLSoftware | Digital Experience | 9.5 | - |
|
II. Public POCs for CVE-2026-67075
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67075
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-67075 (1)
IV. Related Vulnerabilities
Same product: Digital Experience
-
CVE-2026-21837
HCL Digital Experience is affected by an OS command injectio -
CVE-2025-62326
HCL Digital Experience is susceptible to stored cross-site s -
CVE-2025-31988
HCL Digital Experience is susceptible to cross site scriptin -
CVE-2023-37538
HCL Digital Experience is susceptible to cross site scriptin
Same vendor: HCLSoftware
-
CVE-2026-67071
HCL DevOps Deploy / HCL Launch is susceptible to an Improper -
CVE-2026-21827
HCL Connections is vulnerable to an information disclosure v -
CVE-2025-62341
HCL Connections is vulnerable to server-side request forgery -
CVE-2026-21808
HCL BigFix Quantum Risk Analyzer is affected by logging sens -
CVE-2026-21807
HCL BigFix Quantum Risk Analyzer is affected by a stack-base
Same weakness: CWE-79
-
CVE-2026-56589
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-102378
WordPress Parallax Section block plugin <= 2.0.4 - Cross Sit -
CVE-2026-97273
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.1 -
CVE-2026-97268
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.1 -
CVE-2026-97260
WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting
V. Comments for CVE-2026-67075
No comments yet