CVE-2025-62320
Medium
Description
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.
SeverityMedium
CVSS4.7
Exploit probability—
ProductHcltech Unica
PublishedMar 17, 2026
First seenMar 17, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- hcltech unica12.1.11, 25.1.1.0.1 or later
- hcltech unica_audience_central12.1.11, 25.1.1.0.1 or later
- hcltech unica_campaign12.1.11, 25.1.1.0.1 or later
- hcltech unica_centralised_offer_management12.1.11, 25.1.1.0.1 or later
- hcltech unica_contact_central12.1.11, 25.1.1.0.1 or later
- hcltech unica_interact12.1.11, 25.1.1.0.1 or later
- hcltech unica_journey12.1.11, 25.1.1.0.1 or later
- hcltech unica_plan12.1.11, 25.1.1.0.1 or later
- hcltech unica_segment_central12.1.11, 25.1.1.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hcltech unica | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_audience_central | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_campaign | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_centralised_offer_management | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_contact_central | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_interact | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_journey | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_plan | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
| hcltech unica_segment_central | v < 12.1.11, 25.1.0 ≤ v < 25.1.1.0.1 | 12.1.11, 25.1.1.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.