CVE-2025-52655

LowCVSS 3.1/10Last modified Oct 8, 2026

Description

Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published
Oct 10, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-526567.6HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to applicaCVE-2025-526573.5HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characterCVE-2025-526584.8HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could beCVE-2025-526597.5HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic conteCVE-2025-52664.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnCVE-2025-526609.8HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthoriCVE-2025-526615.3HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resultiCVE-2025-526626.1A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under CVE-2025-526637.3A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This iCVE-2025-526648.8SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by loggCVE-2025-5266510.0A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, tCVE-2025-526662.7Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator