CVE-2025-62314

MediumCVSS 5.6/10Last modified Sep 29, 2026

Description

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-623153.4HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or cra CVE-2025-623162.3HCL AION is affected by a vulnerability where certain security-related HTTP response headers are not properly configured. Absence of these h CVE-2025-623172.6HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may ex CVE-2025-623183.7HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowi CVE-2025-623199.8Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE CVE-2025-62327.8An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute co CVE-2025-623206.1HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpa CVE-2025-623264.8HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated CVE-2025-623274.9In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved CVE-2025-623283.7HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allo CVE-2025-623295.6HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to CVE-2025-62334.9Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments