ZeroDay Findings
Sign inSign up

Findings

CVE-2025-62320

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage.

Published Mar 17, 2026 · updated Jun 17, 2026 · hcltech unica

HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 17, 2026 · NIST NVD

    Detected

    HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

  2. Jun 17, 2026 · NIST NVD

    Updated

    HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.

Affected

  • cpe hcltech/unicaversion unspecified
  • cpe hcltech/unica audience centralversion unspecified
  • cpe hcltech/unica campaignversion unspecified
  • cpe hcltech/unica centralised offer managementversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-62320

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2025-62320

    HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact

    nvd.nist.gov

References