High severity · published Oct 3, 2025
CVE-2025-52656
HCL MyXalytics product is affected by Mass Assignment vulnerability
7.6
CVSS
0.3%
EPSS
No
On KEV
Description
HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
HCL MyXalytics · HCL
6.6 · source: vendor
DM
Dryice Myxalytics · Hcltech
6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52656
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52656
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411
More from HCL MyXalytics
5.4
CVE-2025-52653
Cross Site Scripting vulnerability in the web application
3.1
CVE-2025-52655
HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.