CVE-2025-31995

LowCVSS 3.5/10Last modified Oct 8, 2026

Description

HCL Unica MaxAI Workbench is vulnerable to improper input validation. This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
HCL Software	MaxAI Workbench	v12.1.10 - v25.1

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124425

Timeline

Published: Oct 13, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-319967.5HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as CVE-2025-319977.5HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and CVE-2025-319989.8HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can expl CVE-2025-32009.1An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted comm CVE-2025-320004.3HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is CVE-2025-320016.7Uncontrolled search path for the Intel(R) Processor Identification Utility before version 8.0.43 within Ring 3: User Applications may allow CVE-2025-320029.8Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in I-O DATA network attached hard di CVE-2025-320036.5Out-of-bounds read in the firmware for some 100GbE Intel(R) Ethernet Network Adapter E810 before version cvl fw 1.7.6, cpk 1.3.7 within Ring CVE-2025-320043.9Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalati CVE-2025-320074.4Out-of-bounds read for some TDX before version tdx module 1.5.24 within Ring 0: Hypervisor may allow an information disclosure. Authorized a CVE-2025-320088.6Out-of-bounds write in the firmware for the Intel(R) AMT and Intel(R) Standard Manageability within Ring 3: User Applications may allow a de CVE-2025-32015.9The Contact Form builder with drag & drop for WordPress WordPress plugin before 2.4.3 does not sanitise and escape some of its settings, wh