Hcltech Unica vulnerabilities

CVE-2024-42210 Medium · 5.4 CWE-79 Mar 19, 2026

HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability

A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.

CVE-2025-62320 Medium · 6.1 CWE-79 Mar 17, 2026

HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

CVE-2025-62319 Critical · 9.8 CWE-89 Mar 16, 2026

Boolean-Based SQL Injection in Multiple Unica Components

Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.

CVE-2025-51736 Medium · 6.3 CWE-434 Nov 28, 2025

Unrestricted Upload of File with Dangerous Type in Hcltech Unica

File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-51735 High · 7.5 CWE-1236 Nov 28, 2025

CSV Injection in Hcltech Unica

CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-51734 Medium · 5.4 CWE-79 Nov 28, 2025

Cross-site Scripting (XSS) in Hcltech Unica

Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-51733 Medium · 5.5 CWE-352 Nov 28, 2025

Cross-Site Request Forgery (CSRF) in Hcltech Unica

Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-31996 High · 7.5 CWE-552 Oct 13, 2025

Unprotected files are impacting HCL Unica Platform

HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.

CVE-2025-52615 Medium · 5.3 CWE-693 Oct 12, 2025

HCL Unica Platform is impacted by misconfigured security related HTTP headers

HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.

CVE-2025-52614 Medium · 4.3 CWE-614 Oct 12, 2025

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.

CVE-2025-31969 Medium · 6.1 CWE-358 Oct 12, 2025

HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)

HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.

CVE-2025-52616 High · 7.5 CWE-497 Oct 12, 2025

HCL Unica 12.1.10 is affected by an exposure of sensitive information

HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.