By vendor

Hcltech vulnerabilities

Known CVEs affecting Hcltech products, prioritized by severity, with SEC.co remediation and detection guidance.

13 published vulnerabilities

• CVE-2026-21837HIGH 8.8

  HCL Digital Experience contains an OS command injection flaw in its Digital Asset Management API that allows authenticated attackers to run arbitrary commands on the underlying system. Because the API typically executes with application-level privileges, successful exploitation could grant an attacker a foothold to pivot deeper into your infrastructure or exfiltrate sensitive data. This is a post-authentication vulnerability, meaning an attacker needs valid credentials to exploit it.

• CVE-2023-37524HIGH 7.7

  HCL Traveler for Microsoft Outlook relies on .NET Framework 4.5, which reached end-of-life years ago and no longer receives security patches. This means the application sits on top of a foundation with known, unfixed vulnerabilities that attackers can exploit. When a third-party component falls out of support, you're essentially running with one hand tied behind your back—security gaps accumulate and become actionable by threat actors.

• CVE-2025-52612HIGH 7.1

  HCL iControl contains a vulnerability that combines CSV injection with reflected cross-site scripting (XSS) in its export function. An authenticated attacker can craft malicious input that, when a user interacts with exported CSV content or follows a specially crafted link, executes arbitrary JavaScript in the victim's browser session. The vulnerability stems from inadequate input validation and sanitization, allowing attackers to inject both CSV formulas and script payloads.

• CVE-2024-23581MEDIUM 6.7

  HCL Traveler for Microsoft Outlook is triggering false-positive security alerts—antivirus software and system defenses are flagging legitimate application libraries as potentially malicious. This happens because the application's code or digital signatures are not recognized by security tools, causing them to block or quarantine the software incorrectly. The vulnerability itself stems from weak or missing integrity verification, allowing an attacker with local access and user interaction to potentially compromise the application's execution environment or tamper with its operations.

• CVE-2026-21825MEDIUM 6.1

  HCL Digital Experience and Digital Experience Compose contain a reflected cross-site scripting (XSS) vulnerability in their search center functionality. An attacker can craft a malicious link containing JavaScript code and trick a user into clicking it. When the victim visits the link, the attacker's script executes in their browser with their privileges, potentially stealing session cookies, credentials, or performing actions on their behalf. This vulnerability requires user interaction—the victim must click a malicious link—which somewhat limits its reach, but the ability to target any user makes it a meaningful risk for organizations relying on these platforms.

• CVE-2026-21826MEDIUM 6.1

  HCL Digital Experience and HCL Digital Experience Compose contain a host header injection vulnerability that allows an attacker to manipulate how the application processes the Host header in HTTP requests. By injecting a malicious Host value, an attacker can trigger unexpected application behavior, potentially leading to phishing attacks, cache poisoning, or credential theft. The vulnerability requires user interaction—such as clicking a malicious link—to be exploited, which moderates the overall risk profile.

• CVE-2025-59868MEDIUM 5.5

  HCL Traveler for Microsoft Outlook contains a vulnerability that allows an authenticated attacker on the same system to read sensitive application data. An attacker with local access and valid user credentials could extract confidential information, which could then be leveraged for further attacks or cause unpredictable application behavior. This is a local privilege concern rather than a remote network attack.

• CVE-2025-52606MEDIUM 4.3

  HCL iControl contains a weakness in how it validates user input during its security architecture implementation. The application fails to properly check that incoming data matches the expected type before processing it, allowing an authenticated attacker to submit malformed input that the system does not adequately verify. This can lead to unintended modifications of application state or data.

• CVE-2025-59872MEDIUM 4.3

  HCL ZIE for Web contains a file upload vulnerability that allows authenticated users to upload files without proper restrictions. If the server is configured to execute code—a common default in web environments—an attacker could upload a malicious script (web shell) to gain remote command execution. The vulnerability requires an authenticated account and depends on server configuration, which limits its immediate risk but makes it a serious concern in environments where these conditions are met.

• CVE-2025-52609LOW 3.7

  HCL iControl is missing HTTP security headers that would instruct modern web browsers to block cross-site scripting (XSS) attacks. Without these headers—such as Content-Security-Policy or X-XSS-Protection—the application relies on older browser XSS filters that are inconsistently implemented and increasingly deprecated. An attacker could craft malicious input that, when processed by iControl, gets reflected in responses without proper sanitization, potentially allowing script execution in users' browsers.

• CVE-2025-52608LOW 3.1

  HCL iControl contains a cookie security misconfiguration that leaves session identifiers and authentication tokens vulnerable to interception and cross-site request forgery attacks. The vulnerability stems from the absence of the Secure and SameSite cookie attributes, combined with an overly permissive cookie path set to root. While the immediate risk is moderate, this configuration flaw can enable attackers to hijack user sessions or trick authenticated users into performing unintended actions.

• CVE-2025-52611LOW 3.1

  HCL iControl v4.0.0 contains a vulnerability where the application crashes and exposes internal error messages, including stack traces, when certain code paths are triggered. The underlying cause is a programming error where the application attempts to access a property (the 'dashboard key') from an object that hasn't been properly initialized or is missing entirely. While an attacker would need valid login credentials to trigger this issue, the exposure of stack trace information could help them understand the application's internal structure and identify further attack vectors.

• CVE-2025-62340LOW 3.1

  HCL iControl contains a session management weakness where user sessions are not automatically terminated after periods of inactivity. This means that if a user walks away from an authenticated session without logging out, an attacker with physical or network access could potentially interact with the application under that user's privileges. The vulnerability requires an attacker to have some level of access and be able to reach the application, limiting the immediate threat, but it does increase risk in shared or public-facing deployments.