CSV injection and reflected XSS in HCL iControl (CVE-2025-52612)

HCL iControl contains a CSV injection vulnerability in its Export CSV functionality, combined with a reflected cross-site scripting (XSS) vulnerability, both caused by insufficient sanitization of input parameters. A remote attacker with low privileges could exploit these flaws to achieve high impact on confidentiality and integrity. Affected versions: - HCL iControl v4.0.0 We recommend updating to: v4.2.0. CVSS 8.8 · our assessment: this_week Reference: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131041 Details: https://vuln.today/cve/CVE-2025-52612