HCL MyXalytics CVE-2025-52653

Exploitation requires an authenticated session (PR:L) on the HCL MyXalytics (DRYiCE MyXalytics 6.6) web application and depends on victim user interaction (UI:R) - a second user must load the page containing the injected payload for the script to fire. Impact is limited to the web application context (C:L/I:L, no availability impact). Limiting factors: the attacker must already hold valid low-privilege credentials, a victim must be induced to view the malicious content, and only the single confirmed version 6.6 is listed as affected. The specific injectable parameter and whether the XSS is stored or reflected are not specified in the advisory.

All exploitation signals point to a low-priority issue despite the medium CVSS 5.4. The vendor vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) describes an authenticated (PR:L) cross-site scripting flaw that requires victim interaction (UI:R) and yields only limited confidentiality and integrity impact (C:L/I:L, A:N) - the scope change (S:C) reflects script execution crossing into the victim's browser context, which is standard for XSS. EPSS is very low at 0.03% (9th percentile), there is no CISA KEV listing (confirmed actively exploited = NO), and no public exploit code is referenced (POC = NO). No SSVC decision data was supplied. Signals are internally consistent - a low-EPSS, authenticated, interaction-dependent XSS in a niche analytics product is a genuine low-risk finding, not a high-CVSS-but-overstated case nor an understated one. No conflicts between the vector and the description were found.

An authenticated attacker with access to the MyXalytics web application injects a malicious script payload into a user-controllable field; when another user (e.g. an administrator) views the affected page, the script executes in their browser session. This could enable session/token theft or unauthorized actions performed as the victim. No public exploit code is identified at time of analysis.