CVE-2025-52654 Details
Description
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
A vulnerability allowing HTML injection has been identified in HCL MyXalytics version 6.6. This issue arises when untrusted input is output without proper sanitization, potentially enabling unauthorized content injection and manipulation.
Users can upgrade to HCL MyXalytics version 6.7, which addresses this vulnerability. For assistance with the upgrade, contact the HCL MyXalytics support team.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hcltech dryice myxalytics | 6.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2025 | CVE Modified | [email protected] |
| Oct 8, 2025 | Initial Analysis | [email protected] |
| Oct 3, 2025 | New CVE Received | [email protected] |