CVE-2025-59873

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

An information exposure vulnerability exists in

Vulnerability in HCL Software ZIE for Web.

The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions

This issue affects ZIE for Web: v16.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-598

Affected software

No affected versions have been published.

Timeline

Published: Feb 23, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-598748.1HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keycloak component of the web a CVE-2025-59885.3A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to e CVE-2025-598868.8Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t CVE-2025-598878.6Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker CVE-2025-598886.7Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with CVE-2025-598898.6Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the CVE-2025-598907.3Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead int CVE-2025-598918.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat CVE-2025-598928.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat CVE-2025-598938.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat CVE-2025-598948.0Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticat CVE-2025-598957.5Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the conf