EUVD-2026-90498
GHSA-3mgv-h6w3-62pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTML-injection payload in request parameter
-
DeliveryDeliver malicious link to portal user
-
ExploitVictim loads page on trusted DX domain
-
ExecutionUnsanitized HTML renders in page
-
ImpactSpoofed content deceives user (phishing)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires victim user interaction (UI:R) - a user must load attacker-controlled HTML content within an HCL Digital Experience portal page (e.g., by clicking a crafted link or viewing injected input). No authentication is required of the attacker (PR:N), and the vector is network-reachable, but the impact is limited to rendering spoofed HTML content under the trusted portal domain rather than script execution or data theft. Limiting factors: the dependence on social engineering to get a victim to load the payload, the integrity-only impact (no confidentiality or availability loss), and that fixed builds (9.5 CF238+) are available. Applies to HCL Digital Experience instances running versions prior to 9.5 CF238. |
| Impact | Signals are consistent in pointing to a moderate, non-urgent issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N = 6.5) describes an unauthenticated, network-reachable flaw that nonetheless requires user interaction (UI:R) and yields no confidentiality or availability impact - only integrity. The I:H rating appears generous for the described impact: the text characterizes this as HTML injection enabling content spoofing from a trusted domain, which is typically an integrity-LOW (defacement/phishing) outcome rather than integrity-HIGH (verify with HCL, as full script execution / session takeover is not asserted). No EPSS score, KEV listing, SSVC decision data, or POC is provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a real but low-priority web-app injection bug - patch in normal cycles rather than as an emergency. The main risk driver is reputational (phishing content served under a trusted HCL DX URL), not system compromise. |
| Exploit ScenarioDerived | An attacker crafts a URL or input containing unsanitized HTML and lures a user into loading it within an HCL Digital Experience portal page. The injected markup renders as part of the trusted portal domain, allowing the attacker to display spoofed content (e.g., a fake login prompt or misleading message) that appears legitimate, facilitating phishing or social engineering. No public proof-of-concept is identified at this time, and successful exploitation depends on victim interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
HTML injection in HCL Digital Experience portals allows unauthenticated remote attackers to place attacker-controlled markup into portal pages, spoofing content that appears to be served from the trusted portal domain; exploitation requires the victim to load the crafted page or link (UI:R), and the assessed impact is integrity-only with no confidentiality or availability loss. No public exploit code or confirmed active exploitation was identified at the time of analysis, and signals are consistent in pointing to a moderate, non-urgent issue. A vendor fix is available in HCL Digital Experience 9.5 CF238 or later.
RemediationAI
Vendor-released patch: HCL Digital Experience 9.5 CF238 or later - upgrade to or beyond this cumulative fix level following the instructions in HCL knowledge base article KB0133995 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133995). Where the upgrade cannot be scheduled immediately, compensating controls should target the injection and rendering paths: deploy input validation and HTML-sanitizing rules at the reverse proxy or WAF in front of the portal to strip markup from user-supplied fields, accepting that aggressive signature sets can produce false positives that block legitimate rich-text or HTML content in portal pages; enforce output encoding on any custom themes, portlets, or templates that echo user input, which may require development effort and theme redeployment; and apply a Content-Security-Policy that restricts inline content and framing on portal responses, with the trade-off that strict policies can break embedded widgets and third-party portlets. Because the published impact is content spoofing under a trusted domain rather than script execution, restricting who may submit HTML-bearing input (for example, disabling anonymous or untrusted contributions to portal content fields) meaningfully reduces exposure with limited operational cost. Monitor for anomalous markup in portal requests and, since no public exploit code or active exploitation was identified at the time of analysis, treat this as a moderate priority to be resolved through routine patch cycles rather than an emergency change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (improper neutralization of input during web page generation), reflected in HCL's description as improper input sanitation. Input accepted by the portal is rendered back into page output without adequate encoding or filtering, so an attacker can inject arbitrary HTML markup that the browser interprets as part of the trusted HCL Digital Experience page. Notably, the injection is characterized here as HTML injection enabling content spoofing rather than script execution, which is why the independent assessment rates integrity impact as Low even though the published CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, score 6.5) assumes a High integrity impact; the reachable vector is network-based with no attacker authentication (PR:N) but is gated by required victim interaction (UI:R), and there is no confidentiality or availability impact in either reading. The affected component is identified by CPE cpe:2.3:a:hclsoftware:digital_experience:*:*:*:*:*:*:*:*, confirming that the product itself - not a separate plugin or library - is the vulnerable surface. Because the payload renders under the portal's own origin, the practical risk is misleading content, forged notices, or deceptive links presented to portal users who trust the domain, rather than session compromise or credential theft.
Know when Hcl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Unauthenticated network reach but requires victim to load the payload (UI:R); content spoofing via HTML injection is integrity-LOW, with no confidentiality or availability impact.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensi
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
HCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vu
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyon
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) ser
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Exploit-DB