CVE-2025-62309

LowCVSS 2.6/10Last modified Oct 7, 2026

Description

HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific conditions.

Metrics

CVSS 3.1 2.6/10CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-201

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-62317.8An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute coCVE-2025-623105.4HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensiCVE-2025-623114.3HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitCVE-2025-623123.0HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms CVE-2025-623135.4HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated auCVE-2025-623145.6HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests mayCVE-2025-623153.4HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or craCVE-2025-623162.3HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these hCVE-2025-623172.6HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may exCVE-2025-623183.7HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowiCVE-2025-623199.8Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUECVE-2025-62327.8An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute co
CVE-2025-62309: Low severity, CVSS 2.6 | Vulnix