XSS in Hcl Software Unica Campaign
CVE-2025-31994
HCL Unica Campaign 12.1.10 is vulnerable to Reflected Cross-Site Scripting (XSS) where an attacker injects malicious script into an HTTP request, which is then reflected unsafely in the server's immediate response to the victim's browser, executing the script as if it originated from the trusted website.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (6.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L.
Affected products
- Hcl Software Unica Campaign — versions <= 12.1.10
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-31994?
- CVE-2025-31994 is a medium-severity vulnerability in Hcl Software Unica Campaign, classified under Cross-site Scripting. CVSS score: 4.3/10. Published 2025-10-13.
- How severe is CVE-2025-31994?
- Medium severity. CVSS v3 base score is 4.3 out of 10.