What’s Vulnerable › Vulnerabilities
CVE-2025-62319: Boolean-Based SQL Injection in Multiple Unica Components
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-16 · updated 2026-06-17
- Weakness: CWE-89
Description
Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.
Affected products
- HCL Software HCL Unica Platform: before 25.1.1.0.1 — fixed in 25.1.1.0.1
- Hcltech Unica Audience Central: before 25.1.1.0.1 — fixed in 25.1.1.0.1
How to fix
Upgrade to a fixed version: HCL Software HCL Unica Platform 25.1.1.0.1; Hcltech Unica Audience Central 25.1.1.0.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-62319 or the next vulnerability affects your stack