CVE-2025-31966 Boolean-Based SQL Injection in Multiple Unica Components
Attackers can bypass client-side validation to perform boolean-based SQL injection, potentially reading sensitive data from HCL Sametime.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-31966?
CVE-2025-31966 is a low-severity SQL injection vulnerability in HCL Sametime, published on 17 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.
Weakness: CWE-20
Which versions are affected by CVE-2025-31966?
It affects 1 product.
Products include Hcltech Sametime.
How do I fix CVE-2025-31966?
No fix has been published for CVE-2025-31966 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-31966 being exploited?
There is no known exploitation of CVE-2025-31966 in the wild and no public exploit code.
Other vulnerabilities in HCL Sametime
- CVE-2021-27771 HCL Sametime is susceptible a file transfer service vulnerability
- CVE-2021-27772 HCL Sametime is vulnerable to an information disclosure
- CVE-2021-27770 HCL Sametime is vulnerable to arbitrary HTTP requests
- CVE-2022-42446 HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
- CVE-2023-50349 HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
Sources
Also known as GHSA-f5f8-5jp8-vj3c.