High severity · published Mar 26, 2026
CVE-2025-55265
HCL Aftermarket DPC is affected by File Discovery
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it to craft further attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Aftermarket DPC · HCL
version 1.0.0 · source: vendor
AC
Aftermarket Cloud · Hcltech
1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55265
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793
More from Aftermarket DPC
9.8
CVE-2025-55261
HCL Aftermarket DPC is affected by Missing Functional Level Access Control
9.8
CVE-2025-55267
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability
9.8
CVE-2025-55269
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability
9.8
CVE-2025-55270
HCL Aftermarket DPC is affected by Improper Input Validation
8.8
CVE-2025-55271
HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability