CVE-2025-62320: HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-17 · updated 2026-06-17
Weakness: CWE-79

Description

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

Affected products

HCL Software HCL Unica Platform: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
Hcltech Unica Audience Central: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
HCL Software Unica Campaign: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
Hcltech Unica Centralised Offer Management: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
Hcltech Unica Contact Central: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
Hcltech Unica Interact: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
Hcltech Unica Journey: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
Hcltech Unica Plan: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1
Hcltech Unica Segment Central: before 12.1.11; from 25.1.0 before 25.1.1.0.1 — fixed in 12.1.11, 25.1.1.0.1

How to fix

Upgrade to a fixed version: HCL Software HCL Unica Platform 12.1.11, 25.1.1.0.1; Hcltech Unica Audience Central 12.1.11, 25.1.1.0.1; HCL Software Unica Campaign 12.1.11, 25.1.1.0.1; Hcltech Unica Centralised Offer Management 12.1.11, 25.1.1.0.1; Hcltech Unica Contact Central 12.1.11, 25.1.1.0.1; Hcltech Unica Interact 12.1.11, 25.1.1.0.1; Hcltech Unica Journey 12.1.11, 25.1.1.0.1; Hcltech Unica Plan 12.1.11, 25.1.1.0.1; Hcltech Unica Segment Central 12.1.11, 25.1.1.0.1. Check the vendor advisory for mitigations.

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129460

Get alerted when CVE-2025-62320 or the next vulnerability affects your stack