Medium severity · published Oct 3, 2025
CVE-2025-52653
Cross Site Scripting vulnerability in the web application
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
HCL MyXalytics · HCL
6.6 · source: vendor
DM
Dryice Myxalytics · Hcltech
6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52653
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
More from HCL MyXalytics
7.6
CVE-2025-52656
HCL MyXalytics product is affected by Mass Assignment vulnerability
3.1
CVE-2025-52655
HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.