EUVD-2025-208741Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V5 - Validation, Sanitization and Encoding Input validation, output encoding, parameterized queries
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Exposed information (credentials, internal paths, user data, configuration) can be leveraged for further attacks or regulatory violations. With a CVSS score of 2.2 (LOW), this represents a low risk. |
| Exploit ScenarioDerived | An attacker triggers error conditions or accesses improperly protected endpoints to extract sensitive internal information from the application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.
Earlier versions of this analysis (1)
RemediationAI
Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls.
Know when Aion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.
Executive ViewAI
CVE-2025-52646 is a low-severity vulnerability in HCL AION involving SQL injection (CVSS 2.2). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard SQL injection mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in HCL AION Multiple Security Vulnerabilities
View all 7HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-de
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclo
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user inte
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
GitHub PoC
Exploit-DB