Vulnerabilities

TI-2026-17544 CVE-2026-21825 · GHSA-26cp-fff5-jqv5

Cross-site scripting in HCL Software DX Compose

LOW 26

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00152 Published 2026-06-05 No fix listed CWE-79

TI-2026-17545 CVE-2026-21826 · GHSA-xg6r-cjq3-qmj5

Open redirect in HCL Software Digital Experience & DX Compose

LOW 26

HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00144 Published 2026-06-05 No fix listed CWE-601

TI-2026-17550 CVE-2026-21837 · GHSA-89jh-pgw9-qrmm

OS command injection in HCL Software Digital Experience

MEDIUM 41

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0092 Published 2026-06-05 No fix listed CWE-78

TI-2025-38608 CVE-2025-62326 · GHSA-7vm8-ccqm-97q2

Cross-site scripting in HCL Software Digital Experience

LOW 26

HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00183 Published 2026-02-20 No fix listed CWE-79

TI-2025-23117 CVE-2025-31988 · GHSA-hvm6-6m6r-3c5m

Cross-site scripting in HCL Software Digital Experience

LOW 22

HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0024 Published 2025-08-19 No fix listed CWE-79

TI-2023-19137 CVE-2023-37538 · GHSA-q5h8-qcmv-qmcq

Cross-site scripting in HCL Software Digital Experience

MEDIUM 42

HCL Digital Experience is susceptible to cross site scripting (XSS).

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00411 Published 2023-10-11 No fix listed CWE-79

TI-2022-18186 CVE-2022-38653 · GHSA-63gh-hfrq-8rph

HCL Digital Experience is susceptible to cross-site scripting (XSS)

LOW 24

In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00312 Published 2022-12-15 No fix listed CWE-79

TI-2020-03560 CVE-2020-4081 · GHSA-24c4-w46m-qj98

In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).

LOW 28

In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2021-02-02 No fix listed CWE-79

TI-2020-11152 CVE-2020-14255 · GHSA-g32x-jfqv-9fpx

HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive…

LOW 35

HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01071 Published 2021-02-02 No fix listed

TI-2020-11136 CVE-2020-14221 · GHSA-f9rw-7p76-h888

HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.

LOW 24

HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00852 Published 2021-02-02 No fix listed

TI-2020-11138 CVE-2020-14223 · GHSA-v467-x969-4cm4

Cross-site scripting in HCL Digital Experience

LOW 28

HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00641 Published 2020-10-01 No fix listed CWE-79

Vulnerabilities

Filters