NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-21825
Summary

HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.

Publication Date June 5, 2026, 4:16 p.m.
Registration Date June 6, 2026, 4:17 a.m.
Last Update June 11, 2026, 4:24 a.m.
CVSS3.1 : MEDIUM
スコア 6.1
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC) 低
攻撃に必要な特権レベル(PR) 不要
利用者の関与(UI) 要
影響の想定範囲(S) 変更あり
機密性への影響(C) 低
完全性への影響(I) 低
可用性への影響(A) なし
Affected software configurations
Configuration1 or higher or less more than less than
cpe:2.3:a:hcltech:digital_experience_compose:9.5:-:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf224:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf225:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf226:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf227:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf228:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf229:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf230:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf231:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf232:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf233:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf234:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:-:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf17:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf171:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf172:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf173:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf18:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf181:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf182:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf183:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf184:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf19:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf191:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf192:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf193:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf194:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf195:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf196:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf197:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf198:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf199:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf200:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf201:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf202:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf203:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf204:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf205:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf206:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf207:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf208:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf209:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf210:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf211:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf212:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf213:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf214:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf215:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf216:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf217:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf218:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf219:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf220:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf221:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf222:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf223:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf224:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf225:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf226:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf227:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf228:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf229:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf230:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf231:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf232:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf233:*:*:*:*:*:*
cpe:2.3:a:hcltech:digital_experience:9.5:cf234:*:*:*:*:*:*
Related information, measures and tools
Common Vulnerabilities List
JVN Vulnerability Information
HCL Technologies Limitedのdigital experience等の複数製品におけるクロスサイトスクリプティングの脆弱性
Title HCL Technologies Limitedのdigital experience等の複数製品におけるクロスサイトスクリプティングの脆弱性
Summary

HCL Digital Experience Compose は検索センターにおいて反射型クロスサイトスクリプティング（XSS）の脆弱性の影響を受けます。この脆弱性により、攻撃者は被害者のブラウザ上で任意のJavaScriptを実行する可能性があります。

Possible impacts ・当該ソフトウェアが扱う情報の一部が外部に漏れる可能性があります。 ・当該ソフトウェアが扱う情報の一部が書き換えられる可能性があります。 ・当該ソフトウェアは停止しません。 
Solution

ベンダ情報を参照して適切な対策を実施してください。

Publication Date June 5, 2026, midnight
Registration Date June 11, 2026, 4:14 p.m.
Last Update June 11, 2026, 4:14 p.m.
Affected System
HCL Technologies Limited
digital experience 9.5
Digital Experience Compose 9.5
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
No Changed Details Date of change
1 [2026年06月11日]
  掲載		 June 11, 2026, 4:14 p.m.