CVE-2025-62311

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to potential interception or unauthorized access during transmission under certain conditions

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-623123.0HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms CVE-2025-623135.4HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated au CVE-2025-623145.6HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may CVE-2025-623153.4HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or cra CVE-2025-623162.3HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these h CVE-2025-623172.6HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may ex CVE-2025-623183.7HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowi CVE-2025-623199.8Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE CVE-2025-62327.8An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute co CVE-2025-623206.1HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpa CVE-2025-623264.8HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated CVE-2025-623274.9In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved