CVE-2025-31994

HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then reflected unsafely in the server's immediate response to the victim's browser, executing the script as if it originated from the trusted website.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2025-10-13

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124472

Check your stackJSON