CVE-2025-52655— HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-52655
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.
Source: NVD (National Vulnerability Database)
Vulnerability Description
Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
从非可信控制范围包含功能例程
Source: NVD (National Vulnerability Database)
Vulnerability Title
HCL MyXalytics 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL MyXalytics是印度HCL公司的一款分析类软件产品。用于进行数据分析等相关工作。 HCL MyXalytics v6.6版本存在安全漏洞，该漏洞源于加载第三方脚本时未进行完整性检查或验证，可能导致外部代码在应用程序环境中运行，存在数据泄露风险。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL | HCL MyXalytics | 6.6 | - |
II. Public POCs for CVE-2025-52655
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-52655
请登录查看更多情报信息。
Same Patch Batch · HCL · 2025-10-10 · 8 CVEs total
| CVE-2025-52650 | 8.2 HIGH | HCL AION is susceptible to Inline script execution allowed in CSP vulnerability |
| CVE-2025-52632 | 6.5 MEDIUM | HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vuln |
| CVE-2025-52624 | 5.4 MEDIUM | HCL AION is susceptible to Bypass of the script allow list configuration vulnerability |
| CVE-2025-52635 | 3.7 LOW | HCL AION is susceptible to Trusted types in scripts not enforced in CSP |
| CVE-2025-52634 | 3.7 LOW | HCL AION is susceptible to Spring Boot Actuator Endpoints Exposed |
| CVE-2025-52625 | 3.7 LOW | HCL AION is susceptible to Cacheable SSL Page Found vulnerability |
| CVE-2025-52630 | 3.7 LOW | HCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerabili |
IV. Related Vulnerabilities
Same product: HCL MyXalytics
- CVE-2025-52656
HCL MyXalytics product is affected by Mass Assignment vulner - CVE-2025-52654
HCL MyXalytics is affected by an HTML Injection - CVE-2025-52653
Cross Site Scripting vulnerability in the web application - CVE-2024-42178
HCL MyXalytics is affected by a failure to restrict URL acce - CVE-2024-42177
HCL MyXalytics is affected by SSL∕TLS Protocol affected with
Same vendor: HCL
- CVE-2024-30151
HCL BigFix Service Management (SM) is susceptible to Broken - CVE-2025-31960
HCL BigFix Service Management (SM) is vulnerable to informat - CVE-2025-31975
HCL BigFix Service Management (SM) is affected by an Informa - CVE-2025-52613
HCL BigFix Service Management (SM) is affected by use of a v - CVE-2025-31984
HCL BigFix Service Management (SM) is affected by a security
Same weakness: CWE-829
- CVE-2026-45184
Kdenlive 26.04.1前代理参数注入漏洞 - CVE-2026-43571
OpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Res - CVE-2026-43569
OpenClaw < 2026.4.9 - Untrusted Provider Plugin Auto-enablem - CVE-2026-43003
OpenStack ironic-python-agent 安全漏洞 - CVE-2026-41396
OpenClaw < 2026.3.31 - Environment Variable Override of Plug
V. Comments for CVE-2025-52655
No comments yet