Medium severity · published Mar 26, 2026
CVE-2025-55274
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to attackers, unauthorized access to APIs, and possible data manipulation or leakage. If an attacker to exploit CORS misconfiguration, they could steal sensitive data, perform actions on behalf of a legitimate user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Aftermarket DPC · HCL
version 1.0.0 · source: vendor
AC
Aftermarket Cloud · Hcltech
1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55274
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55274
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793
More from Aftermarket DPC
9.8
CVE-2025-55261
HCL Aftermarket DPC is affected by Missing Functional Level Access Control
9.8
CVE-2025-55267
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability
9.8
CVE-2025-55269
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability
9.8
CVE-2025-55270
HCL Aftermarket DPC is affected by Improper Input Validation
8.8
CVE-2025-55271
HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability