CVE-2025-0248

HighCVSS 8.1/10Last modified Oct 18, 2026

Description

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 25, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-02495.9HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers CVE-2025-02504.9HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being hand CVE-2025-02515.7HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credential CVE-2025-02524.8HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially CVE-2025-02532.4HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could CVE-2025-02545.9HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attack CVE-2025-02557.2HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending CVE-2025-02566.5HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to miss CVE-2025-02577.5HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing auth CVE-2025-02727.6HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web CVE-2025-02735.5HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user CVE-2025-02744.3HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small sub