Vulnerabilidades do Hcltech Unica

CVE-2024-42210 Média · 5.4 CWE-79 19/03/2026

HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability

A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.

CVE-2025-62320 Média · 6.1 CWE-79 17/03/2026

HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

CVE-2025-62319 Crítica · 9.8 CWE-89 16/03/2026

Boolean-Based SQL Injection in Multiple Unica Components

Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.

CVE-2025-51736 Média · 6.3 CWE-434 28/11/2025

Unrestricted Upload of File with Dangerous Type em Hcltech Unica

File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-51735 Alta · 7.5 CWE-1236 28/11/2025

CSV Injection em Hcltech Unica

CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-51734 Média · 5.4 CWE-79 28/11/2025

Cross-site Scripting (XSS) em Hcltech Unica

Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-51733 Média · 5.5 CWE-352 28/11/2025

Cross-Site Request Forgery (CSRF) em Hcltech Unica

Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CVE-2025-31996 Alta · 7.5 CWE-552 13/10/2025

Unprotected files are impacting HCL Unica Platform

HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system information that can be exploited by attackers to compromise the application, infrastructure, or users.

CVE-2025-52615 Média · 5.3 CWE-693 12/10/2025

HCL Unica Platform is impacted by misconfigured security related HTTP headers

HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for the policies controlled by these headers.

CVE-2025-52614 Média · 4.3 CWE-614 12/10/2025

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.

CVE-2025-31969 Média · 6.1 CWE-358 12/10/2025

HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)

HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.

CVE-2025-52616 Alta · 7.5 CWE-497 12/10/2025

HCL Unica 12.1.10 is affected by an exposure of sensitive information

HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.