{"id":"CVE-2025-31995","state":"PUBLISHED","title":"HCL Unica MaxAI Workbench is vulnerable to improper input validation","description":"HCL Unica MaxAI Workbench is vulnerable to improper input validation.  This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc.","publishedAt":"2025-10-13T04:58:20.465Z","updatedAt":"2025-10-14T19:36:39.714Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","source":"HCL"},"assigner":"HCL","products":["HCL Software MaxAI Workbench"],"affected":[{"vendor":"HCL Software","product":"MaxAI Workbench","defaultStatus":"unaffected","versions":[{"version":"v12.1.10 - v25.1","status":"affected"}]}],"references":["https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124425"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/31xxx/CVE-2025-31995.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-31995","state":"PUBLISHED","datePublished":"2025-10-13T04:58:20.465Z","dateUpdated":"2025-10-14T19:36:39.714Z","assignerShortName":"HCL","assignerOrgId":"1e47fe04-f25f-42fa-b674-36de2c5e3cfc","dateReserved":"2025-04-01T18:46:35.961Z"},"containers":{"cna":{"title":"HCL Unica MaxAI Workbench is vulnerable to improper input validation","descriptions":[{"lang":"en","value":"HCL Unica MaxAI Workbench is vulnerable to improper input validation.  This allows attackers to exploit vulnerabilities such as SQL Injection, XSS, or command injection, leading to unauthorized access or data breaches, etc."}],"affected":[{"vendor":"HCL Software","product":"MaxAI Workbench","defaultStatus":"unaffected","versions":[{"version":"v12.1.10 - v25.1","status":"affected"}]}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124425"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"HCL","orgId":"1e47fe04-f25f-42fa-b674-36de2c5e3cfc","dateUpdated":"2025-10-13T04:58:20.465Z"},"datePublic":"2025-10-13T04:55:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-10-14T19:35:20.568571Z","id":"CVE-2025-31995","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-14T19:36:39.714Z"}}]}}}