CVE-2025-52618

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability. The vulnerability allows potential attackers to manipulate SQL queries.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Aug 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526195.3HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure. Under certain conditions, error messages disclose CVE-2025-52627.5A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This cou CVE-2025-526205.4HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequate CVE-2025-526217.5HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Ori CVE-2025-526225.4The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side secu CVE-2025-526236.5HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on passwo CVE-2025-526246.1A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may al CVE-2025-526257.5A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system ide CVE-2025-526269.8A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthori CVE-2025-526277.5Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, pot CVE-2025-526288.8HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-sit CVE-2025-526296.1HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting a