CVE-2025-31988 HCL Digital Experience is susceptible to cross site scripting (XSS)

What is CVE-2025-31988?

CVE-2025-31988 is a medium-severity cross-site scripting vulnerability in HCL Software Digital Experience, published on 19 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.

Weakness: CWE-79

Which versions are affected by CVE-2025-31988?

It affects 1 product.

Products include Hcltech Digital Experience.

How do I fix CVE-2025-31988?

No fix has been published for CVE-2025-31988 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-31988 being exploited?

There is no known exploitation of CVE-2025-31988 in the wild and no public exploit code.

Other vulnerabilities in HCL Software Digital Experience

• CVE-2023-37538 HCL Digital Experience is susceptible to cross site scripting (XSS) Critical 9.3
• CVE-2026-21837 HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API High 8.7
• CVE-2020-14255 HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. High 7.5
• CVE-2026-21825 HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center Medium 6.1
• CVE-2026-21826 HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hvm6-6m6r-3c5m.