Medium severity · published Mar 17, 2026
CVE-2025-62320
HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sametime · HCL
version 25.1.1 and below. · source: vendor
UN
Unica · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
UA
Unica Audience Central · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
UC
Unica Campaign · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
UC
Unica Centralised Offer Management · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
UC
Unica Contact Central · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
UI
Unica Interact · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
UJ
Unica Journey · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
UP
Unica Plan · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
US
Unica Segment Central · Hcltech
before 12.1.11; 25.1.0 before 25.1.1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62320
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62320
Patch
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129460
More from Sametime
3.3
CVE-2026-21791
HCL Sametime for Android is affected by sensitive information disclosure
2.7
CVE-2025-31966
Boolean-Based SQL Injection in Multiple Unica Components