Unica
Monthly
This is a Local File Inclusion (LFI) vulnerability in AncoraThemes Unica WordPress theme versions up to and including 1.4.1, where improper control of filenames in PHP include/require statements allows attackers to read arbitrary local files from the affected server. An unauthenticated remote attacker can exploit this vulnerability to disclose sensitive information such as configuration files, database credentials, or other sensitive data stored on the server. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and has been documented by Patchstack with ENISA EUVD tracking ID EUVD-2026-15528.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend database queries through specially crafted input fields. The vulnerability affects HCL Unica version 25.1.1 and below, enabling unauthenticated attackers to extract sensitive data, modify database contents, or potentially compromise the entire system. With a critical CVSS score of 9.8 and network-based attack vector requiring no authentication, this represents a severe risk to organizations using affected Unica installations.
File upload vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CSV formula injection vulnerability in HCL Technologies Ltd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Unica Platform exposes unprotected files to network-reachable clients because of improper access controls, allowing an unauthenticated remote attacker to read sensitive application or system data (CVSS 3.1 base 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no credentials or user interaction are required - the only real precondition is that the Unica instance is reachable over the network and the affected files remain served without authorization checks in the default/unpatched state. There is no public exploit identified at time of analysis, but the flaw is low-complexity and trivially automatable once the readable paths are located; EPSS and KEV data were not provided, and the impact is confined to confidentiality (no integrity or availability effect) per the vendor and independent assessment.
Misconfigured HTTP security headers in HCL Unica Platform leave its web interface without critical browser protections, allowing less secure default treatment for policies such as content security, clickjacking, and transport security. All versions of HCL Unica (per CPE) are potentially affected. This is a low-priority, defense-in-depth weakness rather than a directly exploitable vulnerability; practical exploitation typically requires a man-in-the-middle position or attacker-influenced content that a proper header policy would have mitigated. No public exploit code has been identified, and EPSS score is 0.21% (10th percentile).
HCL Unica Platform issues session/authentication cookies without the HTTPOnly attribute, so any JavaScript executing in a victim's browser - injected through a separate cross-site scripting flaw or delivered by an attacker-controlled page - can read the cookie value and potentially hijack the session. The missing flag alone discloses nothing: exploitation requires the victim (an authenticated Unica user) to follow an attacker-supplied link (UI:R), and per our independent assessment a companion script-execution vector is needed for real theft, with impact limited to confidentiality (C:L, I:N, A:N). At CVSS 4.3, EPSS 0.14% (3rd percentile), and with no public exploit identified at the time of analysis, this is a genuinely low-priority hardening issue rather than an immediately exploitable flaw.
Misconfigured Content Security Policy (CSP) in HCL Unica Platform allows malicious external resources to be loaded, enabling cross-site scripting (XSS) and clickjacking attacks against users with active Unica sessions. The vulnerability affects all HCL Unica versions per the vendor's CPE designation, and exploitation requires a victim to interact with a crafted link or visit a malicious page (UI:R) while authenticated, though the attacker does not need prior authentication (PR:N). EPSS is 0.16% (5th percentile) with no public exploit code or active exploitation identified, and the CVSS vector shows scope change with low confidentiality and integrity impact-consistent with a moderate-to-low priority issue.
HCL Unica 12.1.10 exposes sensitive system information to remote, unauthenticated attackers who can reach an affected instance over the network, allowing them to map the environment and plan follow-on attacks against known weaknesses in the application. The flaw is a confidentiality-only information disclosure (CWE-497) with no integrity or availability impact, so it enables reconnaissance rather than direct compromise; our independent assessment rates the confidentiality impact as Low, below the input's 7.5 score. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.26% (16th percentile), making exposure management the primary risk driver.
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unica application exposes an API which accepts arbitrary XML input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This is a Local File Inclusion (LFI) vulnerability in AncoraThemes Unica WordPress theme versions up to and including 1.4.1, where improper control of filenames in PHP include/require statements allows attackers to read arbitrary local files from the affected server. An unauthenticated remote attacker can exploit this vulnerability to disclose sensitive information such as configuration files, database credentials, or other sensitive data stored on the server. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and has been documented by Patchstack with ENISA EUVD tracking ID EUVD-2026-15528.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend database queries through specially crafted input fields. The vulnerability affects HCL Unica version 25.1.1 and below, enabling unauthenticated attackers to extract sensitive data, modify database contents, or potentially compromise the entire system. With a critical CVSS score of 9.8 and network-based attack vector requiring no authentication, this represents a severe risk to organizations using affected Unica installations.
File upload vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CSV formula injection vulnerability in HCL Technologies Ltd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL Unica Platform exposes unprotected files to network-reachable clients because of improper access controls, allowing an unauthenticated remote attacker to read sensitive application or system data (CVSS 3.1 base 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no credentials or user interaction are required - the only real precondition is that the Unica instance is reachable over the network and the affected files remain served without authorization checks in the default/unpatched state. There is no public exploit identified at time of analysis, but the flaw is low-complexity and trivially automatable once the readable paths are located; EPSS and KEV data were not provided, and the impact is confined to confidentiality (no integrity or availability effect) per the vendor and independent assessment.
Misconfigured HTTP security headers in HCL Unica Platform leave its web interface without critical browser protections, allowing less secure default treatment for policies such as content security, clickjacking, and transport security. All versions of HCL Unica (per CPE) are potentially affected. This is a low-priority, defense-in-depth weakness rather than a directly exploitable vulnerability; practical exploitation typically requires a man-in-the-middle position or attacker-influenced content that a proper header policy would have mitigated. No public exploit code has been identified, and EPSS score is 0.21% (10th percentile).
HCL Unica Platform issues session/authentication cookies without the HTTPOnly attribute, so any JavaScript executing in a victim's browser - injected through a separate cross-site scripting flaw or delivered by an attacker-controlled page - can read the cookie value and potentially hijack the session. The missing flag alone discloses nothing: exploitation requires the victim (an authenticated Unica user) to follow an attacker-supplied link (UI:R), and per our independent assessment a companion script-execution vector is needed for real theft, with impact limited to confidentiality (C:L, I:N, A:N). At CVSS 4.3, EPSS 0.14% (3rd percentile), and with no public exploit identified at the time of analysis, this is a genuinely low-priority hardening issue rather than an immediately exploitable flaw.
Misconfigured Content Security Policy (CSP) in HCL Unica Platform allows malicious external resources to be loaded, enabling cross-site scripting (XSS) and clickjacking attacks against users with active Unica sessions. The vulnerability affects all HCL Unica versions per the vendor's CPE designation, and exploitation requires a victim to interact with a crafted link or visit a malicious page (UI:R) while authenticated, though the attacker does not need prior authentication (PR:N). EPSS is 0.16% (5th percentile) with no public exploit code or active exploitation identified, and the CVSS vector shows scope change with low confidentiality and integrity impact-consistent with a moderate-to-low priority issue.
HCL Unica 12.1.10 exposes sensitive system information to remote, unauthenticated attackers who can reach an affected instance over the network, allowing them to map the environment and plan follow-on attacks against known weaknesses in the application. The flaw is a confidentiality-only information disclosure (CWE-497) with no integrity or availability impact, so it enables reconnaissance rather than direct compromise; our independent assessment rates the confidentiality impact as Low, below the input's 7.5 score. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.26% (16th percentile), making exposure management the primary risk driver.
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Unica application exposes an API which accepts arbitrary XML input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.