CVE-2026-21825

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
HCLSoftwareDX Compose9.5

References

Timeline

Published
Jun 5, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-218266.1HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the HosCVE-2026-218273.1HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are nCVE-2026-21839.8A security vulnerability has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73.CVE-2026-218303.7HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or nonCVE-2026-218324.3HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may bCVE-2026-218333.7HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps preventCVE-2026-218343.1HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responCVE-2026-218366.5The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, document level access restrCVE-2026-218378.8HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arCVE-2026-21849.8A vulnerability was detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerabCVE-2026-218403.1HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and responCVE-2026-218485.0HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to explo