CVE Catalog
CVE-2025-52609
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk0.16%
6th percentile - higher than 6% of all known CVEs
Summary
HCL iControl has missing security headers, which enables cross-site scripting (XSS) attacks by disabling the built-in XSS filtering mechanisms of modern web browsers.
Risk Assessment
The risk is that malicious scripts can be executed in the victim's browser, potentially leading to session theft, data theft, or redirection to malicious sites.
Recommendation
It is recommended to add appropriate security headers such as X-Content-Type-Options, X-Frame-Options, and Content-Security-Policy to prevent XSS attacks.
Original NVD description (English source)
HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.