CVE-2025-55264

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-552657.5HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the systCVE-2025-552666.5HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized tCVE-2025-552679.8HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining CVE-2025-552685.3HCL Aftermarket DPC is affected by Spamming Vulnerability which can allow the actor to excessive spamming can consume server bandwidth and pCVE-2025-552699.8HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brCVE-2025-55278.8A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticroCVE-2025-552709.8HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks suCVE-2025-552718.8HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split resCVE-2025-552725.3HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version detaCVE-2025-552734.3HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability where an attacker using external scripts can tamper with the DOCVE-2025-552744.3HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive usCVE-2025-552758.1HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijack
CVE-2025-55264: Medium severity, CVSS 5.5 | Vulnix