CVE-2025-52602

HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application.  An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs).  An attacker can use that information to target individuals with phishing or other social-engineering attacks.

• CWE-359

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124950

Published

Nov 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5259The Minimal Share Buttons plugin for WordPress is vulnerable…6.4
• CVE-2025-52598Cybersecurity Nozomi Networks Labs, a specialized security c…3.7
• CVE-2025-52599Cybersecurity Nozomi Networks Labs, a specialized security c…6.5
• CVE-2025-5260Server-Side Request Forgery (SSRF) vulnerability in Pik Onli…8.6
• CVE-2025-52600Cybersecurity Nozomi Networks Labs, a specialized security c…7.2
• CVE-2025-52601Cybersecurity Nozomi Networks Labs, a specialized security c…7.8
• CVE-2025-52603HCL Connections is vulnerable to information disclosure. In…3.5
• CVE-2025-52606HCL iControl was affected by Weak Input Validation vulnerabi…4.3
• CVE-2025-52608HCL iControl was affected by Missing Cookie Attributes vuln…4.3
• CVE-2025-52609HCL iControl was affected by Missing Security Headers vulner…5.3
• CVE-2025-5261Authorization Bypass Through User-Controlled Key vulnerabili…7.5
• CVE-2025-52611HCL iControl v4.0.0 was affected by Unhandled Exception - St…4.3