CVE-2025-52659

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-525

Affected software

Vendor	Product	Versions
HCL Software	AION	2

References

https://support.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b&searchTerm=kb0127995#Vendor Advisory

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-52664.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vuln CVE-2025-526609.8HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthori CVE-2025-526615.3HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulti CVE-2025-526626.1A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under CVE-2025-526637.3A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This i CVE-2025-526648.8SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logg CVE-2025-5266510.0A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, t CVE-2025-526662.7Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an administrator CVE-2025-526675.4Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS attack to be possib CVE-2025-526685.4Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential i CVE-2025-526694.3Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to hav CVE-2025-52675.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerab