CVE-2025-55269

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force techniques to gain unauthorized access to user accounts.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-521

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-55278.8A vulnerability was found in Tenda RX3 16.03.13.11_multi_TDE01. It has been rated as critical. This issue affects the function save_staticroCVE-2025-552709.8HCL Aftermarket DPC is affected by Improper Input Validation which allows an attacker to inject executable code and can carry out attacks suCVE-2025-552718.8HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split resCVE-2025-552725.3HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version detaCVE-2025-552734.3HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability where an attacker using external scripts can tamper with the DOCVE-2025-552744.3HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive usCVE-2025-552758.1HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijackCVE-2025-552765.3HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layoCVE-2025-552776.5HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits avCVE-2025-552788.1Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper vCVE-2025-552796.9This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physCVE-2025-55286.1The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon
CVE-2025-55269: Critical severity, CVSS 9.8 | Vulnix