Threats affecting pkg:maven/com.hcl/unica

4 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.3%	CVE-2025-62319HCL Unica · SQL Injection Critical9.8EPSS 0.3%2026-03-16CVE Database V5CVE-2025-62319 CVE-2025-62319 is a critical SQL injection vulnerability affecting HCL Unica versions 25.1.1 and below. It involves Boolean-based blind SQL injection, where attackers inject Boolean conditions into input fields to manipulate backend SQL queries without triggering visible errors. This flaw allows attackers to execute arbitrary SQL commands, potentially compromising database confidentiality, integrity, and availability. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently reported in the wild, the high CVSS score of 9.8 indicates severe risk. Organizations using affected versions of HCL Unica should prioritize patching or applying mitigations to prevent data breaches, unauthorized data manipulation, or service disruption. Countries with significant deployments of HCL Unica and strategic interest in marketing automation platforms are at higher risk. EPSS 0.3%Vulnerability CWE-89	CVE Database V5	2026-03-16
Medium	5.4	EPSS 0.2%	CVE-2025-51734unica · Cross-site Scripting (XSS) Medium5.4EPSS 0.2%2025-11-28CVE Database V5CVE-2025-51734 Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-11-28
Medium	6.3	EPSS 0.2%	CVE-2025-51736unica · File Upload Medium6.3EPSS 0.2%2025-11-28CVE Database V5CVE-2025-51736 File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0. EPSS 0.2%Vulnerability CWE-434	CVE Database V5	2025-11-28
High	7.5	EPSS 0.4%	CVE-2025-51735unica · CSV Formula Injection High7.5EPSS 0.4%2025-11-28CVE Database V5CVE-2025-51735 CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. EPSS 0.4%Vulnerability CWE-1236	CVE Database V5	2025-11-28

Page 1 of 1