CVE-2025-31998Low· 3.5▾ SunlitHCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service.
unica_centralized_offer_management < 25.1.0.1Upgrade past the affected range:
unica_centralized_offer_management 25.1.0.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-31993Low· 3.5HCL Unica Centralized Offer Management is vulnerable to a potential Server-Side Request Forgery (SSRF)
CVE-2025-31997Medium· 4.2HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR)
CVE-2026-67172Low· 3.7HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints
CVE-2026-67171Medium· 5.3HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information
CVE-2026-67106Medium· 5.3HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data
CVE-2025-31960Medium· 5.3HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module