TI-2023-19137 CVE-2023-37538 · GHSA-q5h8-qcmv-qmcq
Cross-site scripting in HCL Software Digital Experience
Priority MEDIUM 42
HCL Digital Experience is susceptible to cross site scripting (XSS).
HCL Software
Records662All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical66CVSS 9.0–10.0
CVSS high157CVSS 7.0–8.9
Exploited now
HCL Software records in CISA KEVNo HCL Software vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records in Digital Experience · all components
TI-2026-17550 CVE-2026-21837 · GHSA-89jh-pgw9-qrmm
OS command injection in HCL Software Digital Experience
Priority MEDIUM 41
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.
TI-2020-11152 CVE-2020-14255 · GHSA-g32x-jfqv-9fpx
HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive…
Priority LOW 35
HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests.
TI-2020-11138 CVE-2020-14223 · GHSA-v467-x969-4cm4
Cross-site scripting in HCL Digital Experience
Priority LOW 28
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS).
TI-2020-03560 CVE-2020-4081 · GHSA-24c4-w46m-qj98
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
Priority LOW 28
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).
TI-2026-17545 CVE-2026-21826 · GHSA-xg6r-cjq3-qmj5
Open redirect in HCL Software Digital Experience & DX Compose
Priority LOW 26
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.
TI-2026-17544 CVE-2026-21825 · GHSA-26cp-fff5-jqv5
Cross-site scripting in HCL Software DX Compose
Priority LOW 26
HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.
TI-2025-38608 CVE-2025-62326 · GHSA-7vm8-ccqm-97q2
Cross-site scripting in HCL Software Digital Experience
Priority LOW 26
HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.
TI-2022-18186 CVE-2022-38653 · GHSA-63gh-hfrq-8rph
HCL Digital Experience is susceptible to cross-site scripting (XSS)
Priority LOW 24
In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.
TI-2020-11136 CVE-2020-14221 · GHSA-f9rw-7p76-h888
HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.
Priority LOW 24
HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.
TI-2025-23117 CVE-2025-31988 · GHSA-hvm6-6m6r-3c5m
Cross-site scripting in HCL Software Digital Experience
Priority LOW 22
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.