Hcltech Digital Experience vulnerabilities
11 vulnerabilities
Known vulnerabilities in Hcltech Digital Experience, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-62326hclsoftwaredigital experience+1
EPSS score0.18%
HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to exploit.CVE-2025-31988hcl softwaredigital experience+1EPSS score0.24%
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.CVE-2020-14255hcltechdigital_experienceEPSS score1.06%
HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. These affect containers only. These do not affect traditional on-premise installations.CVE-2020-14221hcltechdigital_experienceEPSS score0.84%
HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.CVE-2020-14223hcltechdigital_experienceEPSS score0.64%
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.CVE-2020-4081hcltechdigital_experienceEPSS score0.63%
In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).CVE-2022-38653hcl softwarehcl digital experience+1EPSS score0.31%
In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.CVE-2026-21825hclsoftwaredx compose+2EPSS score0.15%
HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary JavaScript in the victim's browser.CVE-2026-21837hclsoftwaredigital experience+2EPSS score0.92%
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.CVE-2026-21826hclsoftwaredigital experience & dx compose+2EPSS score0.14%
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.CVE-2023-37538hcl softwaredigital experience+1EPSS score0.41%
HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).