Medium severity · published Oct 3, 2025
CVE-2025-52654
HCL MyXalytics is affected by an HTML Injection
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
HCL MyXalytics · HCL Software
6.6 · source: vendor
DM
Dryice Myxalytics · Hcltech
6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52654
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
More from HCL MyXalytics
7.5
CVE-2024-42178
HCL MyXalytics is affected by a failure to restrict URL access vulnerability
6.4
CVE-2024-42177
HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities