CVE-2025-62320

published 2026-03-17

CVE-2025-62320: HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of…

Priority P4 27 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
hcl	sametime	—	—
hcltech	unica	< 12.1.11	12.1.11
hcltech	unica	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_audience_central	< 12.1.11	12.1.11
hcltech	unica_audience_central	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_campaign	< 12.1.11	12.1.11
hcltech	unica_campaign	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_centralised_offer_management	< 12.1.11	12.1.11
hcltech	unica_centralised_offer_management	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_contact_central	< 12.1.11	12.1.11
hcltech	unica_contact_central	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_interact	< 12.1.11	12.1.11
hcltech	unica_interact	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_journey	< 12.1.11	12.1.11
hcltech	unica_journey	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_plan	< 12.1.11	12.1.11
hcltech	unica_plan	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1
hcltech	unica_segment_central	< 12.1.11	12.1.11
hcltech	unica_segment_central	>= 25.1.0 < 25.1.1.0.1	25.1.1.0.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79