CVE-2025-52639

MediumCVSS 6.5/10Last modified Oct 18, 2026

Description

HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

No affected versions have been published.

Timeline

Published
Nov 18, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-52644.8Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command,CVE-2025-526404.7HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separatCVE-2025-526415.3HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure ofCVE-2025-526426.5HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. ExCVE-2025-526437.8HCL AION is affected by a vulnerability where untrusted file parsing operations are not executed within a properly isolated sandbox environmCVE-2025-526448.2HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechCVE-2025-526455.3HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verificatiCVE-2025-526465.3HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. ImproCVE-2025-526476.1The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning AttacksCVE-2025-526489.8HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverifieCVE-2025-526495.3HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attackeCVE-2025-52654.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this comman