CVE-2025-55254

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-601 CWE-613

Affected software

Vendor	Product	Versions
HCL Software	BigFix Remote Control	<= 10.1.0.0326

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332Vendor Advisory

Timeline

Published: Dec 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-55264.3The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belong CVE-2025-552619.8HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may comp CVE-2025-552627.5HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from CVE-2025-552637.5HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in in CVE-2025-552645.5HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they ca CVE-2025-552657.5HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the syst CVE-2025-552666.5HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized t CVE-2025-552679.8HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining CVE-2025-552685.3HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and p CVE-2025-552699.8HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use br CVE-2025-55278.8A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticro CVE-2025-552709.8HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks su