CVE-2025-62320HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage.
Updated under an hour ago ()
Does this affect you?
It affects hcltech unica and 8 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.
- CVSS
- 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Analyzed
- Record last updated
- Jun 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
hcltech unica hcltech:unica | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_audience_central hcltech:unica_audience_central | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_campaign hcltech:unica_campaign | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_centralised_offer_management hcltech:unica_centralised_offer_management | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_contact_central hcltech:unica_contact_central | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_interact hcltech:unica_interact | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_journey hcltech:unica_journey | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_plan hcltech:unica_plan | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
hcltech unica_segment_central hcltech:unica_segment_central | before 12.1.11; from 25.1.0 before 25.1.1.0.1 | NVD |
References
- https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129460patch, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.