HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
References
| Link | Resource |
|---|---|
| https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129107 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
19 Mar 2026, 18:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:hcltech:connections:8.0:cumulative_release1:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release12:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release2:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release9:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release3:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release10:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release6:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:-:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release4:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release7:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release8:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release5:*:*:*:*:*:* cpe:2.3:a:hcltech:connections:8.0:cumulative_release11:*:*:*:*:*:* |
|
| References | () https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129107 - Vendor Advisory | |
| First Time |
Hcltech connections
Hcltech |
19 Mar 2026, 09:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-19 09:16
Updated : 2026-03-19 18:42
NVD link : CVE-2026-21788
Mitre link : CVE-2026-21788
CVE.ORG link : CVE-2026-21788
JSON object : View
Products Affected
hcltech
- connections
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')