CVE-2025-62320

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

• CWE-79

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129460Patch, Vendor Advisory

Published

Mar 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62312HCL AION is affected by a vulnerability where basic authoriz…3
• CVE-2025-62313HCL AION is affected by a vulnerability where adequate prote…5.4
• CVE-2025-62316HCL AION is affected by a vulnerability where certain securi…2.3
• CVE-2025-62317HCL AION is affected by a vulnerability where sensitive info…2.6
• CVE-2025-62319Boolean-Based SQL Injection is a type of blind SQL injection…9.8
• CVE-2025-6232An improper validation vulnerability was reported in Lenovo …8.5
• CVE-2025-62326HCL Digital Experience is susceptible to stored cross-site s…4.8
• CVE-2025-62327In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LL…4.9
• CVE-2025-62328HCL Nomad server on Domino did not configure the frame-ances…3.7
• CVE-2025-62329HCL DevOps Deploy / HCL Launch is susceptible to a race cond…5.6
• CVE-2025-6233Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5…4.9
• CVE-2025-62330HCL DevOps Deploy is susceptible to a cleartext transmission…5.9