CVE-2025-31993

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
HCL Software	Unica Centralized Offer Management	<=25.1

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124422Vendor Advisory

Timeline

Published: Oct 12, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-319944.3HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP req CVE-2025-319953.5HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injectio CVE-2025-319967.5HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as CVE-2025-319977.5HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and CVE-2025-319989.8HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can expl CVE-2025-32009.1An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted comm CVE-2025-320004.3HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is CVE-2025-320016.7Uncontrolled search path for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow CVE-2025-320029.8Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard di CVE-2025-320036.5Out-of-bounds read in the firmware for some 100GbE Intel(R) Ethernet Network Adapter E810 before version cvl fw 1.7.6, cpk 1.3.7 within Ring CVE-2025-320043.9Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalati CVE-2025-320074.4Out-of-bounds read for some TDX before version tdx module 1.5.24 within Ring 0: Hypervisor may allow an information disclosure. Authorized a