CVE-2025-31988
HCL Digital Experience is susceptible to cross site scripting (XSS)
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HCL Digital Experience is susceptible to cross site scripting (XSS)
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.
- Record
CVE-2025-31988- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-25205
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.
- Record
EUVD-2025-25205- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hvm6-6m6r-3c5m
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with...
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.
- Record
GHSA-hvm6-6m6r-3c5m- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.
- Record
CVE-2025-31988- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-31988 is a medium vulnerability (CVSS 4.9) in Hcl Software Digital Experience, published August 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. No source names a fixed version.