Reflected Cross-Site Scripting Flaw in HCL Digital Experience Compose
CVE-2026-21825

6.1MEDIUM

Key Information:

Vendor

HCL Softwaresoftware

Status
Dx Compose
Vendor
CVE Published:
5 June 2026

What is CVE-2026-21825?

A reflected cross-site scripting (XSS) vulnerability exists in HCL Digital Experience Compose's search center. This flaw enables an attacker to inject and execute arbitrary JavaScript code in a user's browser, potentially compromising sensitive user data and enabling various malicious activities. It is crucial for users and administrators to apply necessary patches and follow security best practices to mitigate such risks.

Affected Version(s)

DX Compose 9.5

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.