Hcltech Digital_experience
11 CVEs affecting Hcltech Digital_experience. Latest disclosed: 2026-06-05. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37538 | Critical | 9.3 | 2023-10-11 | HCL Digital Experience is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce… |
CVE-2026-21837 | High | 8.8 | 2026-06-05 | HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating s… |
CVE-2020-14255 | High | 7.5 | 2021-02-02 | HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. These affect conta… |
CVE-2026-21826 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause… |
CVE-2026-21825 | Medium | 6.1 | 2026-06-05 | HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary J… |
CVE-2025-62326 | Medium | 6.1 | 2026-02-20 | HCL Digital Experience is susceptible to stored cross-site scripting (XSS) in the administrative user interface which would require elevated privileges to expl… |
CVE-2020-4081 | Medium | 6.1 | 2021-02-02 | In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS). |
CVE-2020-14223 | Medium | 6.1 | 2020-10-01 | HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS att… |
CVE-2025-31988 | Medium | 4.9 | 2025-08-19 | HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access. |
CVE-2020-14221 | Medium | 4.9 | 2021-02-02 | HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users. |
CVE-2022-38653 | Low | 2.0 | 2022-12-19 | In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded. |