PT-2025-48035 · Hcl · Hcl Notes

Published 2025-11-25 · Updated 2025-11-30 · CVE-2025-0248

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HCL iNotes (affected versions not specified)

Description HCL iNotes is affected by a Reflected Cross-site Scripting (XSS) issue due to insufficient validation of user-provided input. An unauthenticated attacker can create a malicious URL that, when accessed by a victim, allows for the execution of scripts within the victim’s browser, potentially leading to the theft of cookie-based authentication credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

CVE-2025-0248

Affected Products

Hcl Notes

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-0248 · Security Note
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032 · Note
• https://twitter.com/cracbot/status/1995085456242077753 · Twitter Post
• https://t.me/cveNotify/143967 · Telegram Post
• https://twitter.com/CVEnew/status/1993345222940803366 · Twitter Post