CVE-2025-52657

LowCVSS 3.5/10Last modified Oct 19, 2026

Description

HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
HCL SoftwareMyXalyticsv6.6, v6.7, v6.8 and v6.8.0.1

References

Timeline

Published
Sep 7, 2026
Last modified
Oct 19, 2026
NVD status
Undergoing Analysis

Related CVEs from 2025

CVE-2025-526584.8HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could beCVE-2025-526597.5HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic conteCVE-2025-52664.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnCVE-2025-526609.8HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthoriCVE-2025-526615.3HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resultiCVE-2025-526626.1A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under CVE-2025-526637.3A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This iCVE-2025-526648.8SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by loggCVE-2025-5266510.0A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, tCVE-2025-526662.7Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administratorCVE-2025-526675.4Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possibCVE-2025-526685.4Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential i