CVE-2025-52648

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the system

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-526495.3HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attackeCVE-2025-52654.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this commanCVE-2025-526506.1Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0CVE-2025-526513.5HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behCVE-2025-526523.5HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear asCVE-2025-526535.4HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorizeCVE-2025-526544.6HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handliCVE-2025-526553.1Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without inCVE-2025-526567.6HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to applicaCVE-2025-526573.5HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characterCVE-2025-526584.8HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could beCVE-2025-526597.5HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic conte