Priority LOW 34
A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower.
CVSS 3.1HIGH 7.6· Network · High privileges · User interaction · EPSS 0.0018 · Published 2026-03-19 · No fix listed CWE-79
Priority LOW 26
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00168 · Published 2026-03-17 · No fix listed CWE-79
Priority MEDIUM 49
Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00292 · Published 2026-03-16 · No fix listed CWE-89
Priority LOW 27
File upload vulnerability in HCL Technologies Ltd.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00214 · Published 2025-11-28 · No fix listed CWE-434
Priority LOW 39
CSV formula injection vulnerability in HCL Technologies Ltd.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00362 · Published 2025-11-28 · No fix listed CWE-1236
Priority LOW 24
Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00188 · Published 2025-11-28 · No fix listed CWE-79
Priority LOW 24
Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00107 · Published 2025-11-28 · No fix listed CWE-352
Priority LOW 32
HCL Unica Platform is affected by unprotected files due to improper access controls.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00242 · Published 2025-10-13 · No fix listed CWE-552
Priority LOW 23
HCL Unica Platform is impacted by misconfigured security related HTTP headers.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00216 · Published 2025-10-12 · No fix listed CWE-693
Priority LOW 19
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00142 · Published 2025-10-12 · No fix listed CWE-614
Priority LOW 26
HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00164 · Published 2025-10-12 · No fix listed CWE-358
Priority LOW 38
HCL Unica 12.1.10 can expose sensitive system information.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0026 · Published 2025-10-12 · No fix listed CWE-497
Priority LOW 35
A Persistent XSS vulnerability can be carried out in a certain field of Unica Campaign.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00379 · Published 2023-08-03 · Fixed in 12.1.3 CWE-79
Priority LOW 35
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out on certain pages of Unica Platform.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00379 · Published 2023-08-03 · Fixed in 12.1.1 CWE-79
Priority LOW 35
A Persistent Cross-site Scripting (XSS) vulnerability can be carried out in a certain field of the Unica Platform.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00379 · Published 2023-08-03 · Fixed in 12.1.1 CWE-79
Priority MEDIUM 41
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0057 · Published 2023-08-03 · Fixed in 12.1.1
Priority MEDIUM 41
The Unica application exposes an API which accepts arbitrary XML input.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0053 · Published 2023-08-03 · No fix listed CWE-611
Priority LOW 34
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00846 · Published 2022-05-12 · No fix listed CWE-91
THREATIST.IORead the docs