PatchTheCVECVE-2025-62320: HTML Injection can be carried out in Product when a web application does not properly check or clean user inpu
18
Routine
MEDIUM 4.7UPGRADEUPGRADEUPGRADE
CVE-2025-62320 is a medium-severity flaw (CVSS 4.7) affecting unica, unica audience central, unica campaign. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.7 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.2% (top 94%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2026-03-17 |
| Last modified | 2026-06-17 |
Publisher (CNA): HCL Software · Vendor: hcltech
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
hcltech unica UPGRADE
Affected: < 12.1.11 · >= 25.1.0 and < 25.1.1.0.1
Fixed in: 12.1.11, 25.1.1.0.1
Safe to downgrade to: a release before 25.1.0
1. Check installed version
apt-cache policy unica || rpm -q unica || unica --version
2. UPGRADE to 12.1.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade unica
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade unica
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 25.1.0 (Debian / Ubuntu)
apt-cache madison unica
sudo apt install unica=<VERSION_BEFORE_25.1.0>
sudo apt-mark hold unica
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unica
sudo dnf downgrade unica-<VERSION_BEFORE_25.1.0>
sudo dnf versionlock add unica
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hcltech unica audience central UPGRADE
Affected: < 12.1.11 · >= 25.1.0 and < 25.1.1.0.1
Fixed in: 12.1.11, 25.1.1.0.1
Safe to downgrade to: a release before 25.1.0
1. Check installed version
apt-cache policy unica-audience-central || rpm -q unica-audience-central || unica-audience-central --version
2. UPGRADE to 12.1.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade unica-audience-central
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade unica-audience-central
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 25.1.0 (Debian / Ubuntu)
apt-cache madison unica-audience-central
sudo apt install unica-audience-central=<VERSION_BEFORE_25.1.0>
sudo apt-mark hold unica-audience-central
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unica-audience-central
sudo dnf downgrade unica-audience-central-<VERSION_BEFORE_25.1.0>
sudo dnf versionlock add unica-audience-central
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hcltech unica campaign UPGRADE
Affected: < 12.1.11 · >= 25.1.0 and < 25.1.1.0.1
Fixed in: 12.1.11, 25.1.1.0.1
Safe to downgrade to: a release before 25.1.0
1. Check installed version
apt-cache policy unica-campaign || rpm -q unica-campaign || unica-campaign --version
2. UPGRADE to 12.1.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade unica-campaign
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade unica-campaign
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 25.1.0 (Debian / Ubuntu)
apt-cache madison unica-campaign
sudo apt install unica-campaign=<VERSION_BEFORE_25.1.0>
sudo apt-mark hold unica-campaign
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unica-campaign
sudo dnf downgrade unica-campaign-<VERSION_BEFORE_25.1.0>
sudo dnf versionlock add unica-campaign
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hcltech unica centralised offer management UPGRADE
Affected: < 12.1.11 · >= 25.1.0 and < 25.1.1.0.1
Fixed in: 12.1.11, 25.1.1.0.1
Safe to downgrade to: a release before 25.1.0
1. Check installed version
apt-cache policy unica-centralised-offer-management || rpm -q unica-centralised-offer-management || unica-centralised-offer-management --version
2. UPGRADE to 12.1.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade unica-centralised-offer-management
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade unica-centralised-offer-management
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 25.1.0 (Debian / Ubuntu)
apt-cache madison unica-centralised-offer-management
sudo apt install unica-centralised-offer-management=<VERSION_BEFORE_25.1.0>
sudo apt-mark hold unica-centralised-offer-management
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unica-centralised-offer-management
sudo dnf downgrade unica-centralised-offer-management-<VERSION_BEFORE_25.1.0>
sudo dnf versionlock add unica-centralised-offer-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hcltech unica contact central UPGRADE
Affected: < 12.1.11 · >= 25.1.0 and < 25.1.1.0.1
Fixed in: 12.1.11, 25.1.1.0.1
Safe to downgrade to: a release before 25.1.0
1. Check installed version
apt-cache policy unica-contact-central || rpm -q unica-contact-central || unica-contact-central --version
2. UPGRADE to 12.1.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade unica-contact-central
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade unica-contact-central
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 25.1.0 (Debian / Ubuntu)
apt-cache madison unica-contact-central
sudo apt install unica-contact-central=<VERSION_BEFORE_25.1.0>
sudo apt-mark hold unica-contact-central
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unica-contact-central
sudo dnf downgrade unica-contact-central-<VERSION_BEFORE_25.1.0>
sudo dnf versionlock add unica-contact-central
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
hcltech unica interact UPGRADE
Affected: < 12.1.11 · >= 25.1.0 and < 25.1.1.0.1
Fixed in: 12.1.11, 25.1.1.0.1
Safe to downgrade to: a release before 25.1.0
1. Check installed version
apt-cache policy unica-interact || rpm -q unica-interact || unica-interact --version
2. UPGRADE to 12.1.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade unica-interact
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade unica-interact
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 25.1.0 (Debian / Ubuntu)
apt-cache madison unica-interact
sudo apt install unica-interact=<VERSION_BEFORE_25.1.0>
sudo apt-mark hold unica-interact
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list unica-interact
sudo dnf downgrade unica-interact-<VERSION_BEFORE_25.1.0>
sudo dnf versionlock add unica-interact
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-62320?
unica: upgrade to 12.1.11, 25.1.1.0.1; unica audience central: upgrade to 12.1.11, 25.1.1.0.1; unica campaign: upgrade to 12.1.11, 25.1.1.0.1. Exact commands for each OS are on this page.
Is CVE-2025-62320 being exploited?
CVE-2025-62320 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-62320 affect?
CVE-2025-62320 affects unica, unica audience central, unica campaign. Severity is medium (CVSS 4.7). HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads
How urgent is CVE-2025-62320?
Priority 18/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-51735 HIGH 7.5 DOWNGRADE CSV formula injection vulnerability in HCL Technologies Ltd
- CVE-2025-51734 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd
- CVE-2025-31996 MEDIUM 5.3 UPGRADE HCL Unica Platform is affected by unprotected files due to improper access controls
- CVE-2025-62319 CRITICAL 9.8 UPGRADE UPGRADE Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by inje
- CVE-2025-51736 MEDIUM 6.3 DOWNGRADE File upload vulnerability in HCL Technologies Ltd