CVE-2025-52609

MediumCVSS 5.3/10Last modified Jul 22, 2026

Description

HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-52617.5Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of TrusteCVE-2025-526114.3HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined propertCVE-2025-526128.8HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. TCVE-2025-526138.8HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI serCVE-2025-526144.3HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by fCVE-2025-526155.3HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for tCVE-2025-526167.5HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging knowCVE-2025-526189.8HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipuCVE-2025-526195.3HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages discloseCVE-2025-52627.5A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This couCVE-2025-526205.4HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequateCVE-2025-526217.5HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning.  The BigFix SaaS's HTTP responses were observed to include the Ori
CVE-2025-52609: Medium severity, CVSS 5.3 | Vulnix