CVE-2025-52612

HighCVSS 8.8/10Last modified Jul 22, 2026

Description

HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. .

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
HCL	iControl	4.0.0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131041Vendor Advisory

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526138.8HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI ser CVE-2025-526144.3HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by f CVE-2025-526155.3HCL Unica Platform is impacted by misconfigured security related HTTP headers. This can lead to less secure browser default treatment for t CVE-2025-526167.5HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging know CVE-2025-526189.8HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipu CVE-2025-526195.3HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose CVE-2025-52627.5A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This cou CVE-2025-526205.4HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequate CVE-2025-526217.5HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Ori CVE-2025-526225.4The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side secu CVE-2025-526236.5HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on passwo CVE-2025-526246.1A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may al