← Vulnerability feed

Vulnerability record · CVE-2025-52656 · published 3 October 2025

CVE-2025-52656: Hcltech dryice myxalytics mass assignment vulnerability

Hcltech · Dryice Myxalytics

HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.

7.6 CVSS 3.1 High EPSS 0.25% · top 85.0% CWE-915 · Mass assignment
7.6CVSS 3.1 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124411 Vendor Advisory

Track CVE-2025-52656 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-42180Hcltech dryice myxalytics unrestricted file upload vulnerabilityHCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect content types,…EPSS 0.26%9.8CVE-2024-42175Hcltech dryice myxalytics improper input validation vulnerabilityHCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. Th…EPSS 0.28%9.8CVE-2024-42172Hcltech dryice myxalytics improper authentication vulnerabilityHCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to id…EPSS 0.39%9.8CVE-2023-50347Hcltech dryice myxalytics sql injection vulnerabilityHCL DRYiCE MyXalytics is impacted by an insecure SQL interface vulnerability, potentially giving an attacker the ability to execute custom SQL querie…EPSS 0.56%9.8CVE-2023-45722Hcltech dryice myxalytics path traversal vulnerabilityHCL DRYiCE MyXalytics is impacted by path traversal arbitrary file read vulnerability because it uses external input to construct a pathname that is …EPSS 0.66%9.8CVE-2023-45723Hcltech dryice myxalytics path traversal vulnerabilityHCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability.  Certain endpoints permit users to manipulate …EPSS 1.00%9.8CVE-2023-45724Hcltech dryice myxalytics unrestricted file upload vulnerabilityHCL DRYiCE MyXalytics product is impacted by unauthenticated file upload vulnerability. The web application permits the upload of a certain file with…EPSS 0.53%9.4CVE-2024-42168Hcltech dryice myxalytics server-side request forgery (ssrf) vulnerabilityHCL MyXalytics is affected by out-of-band resource load (HTTP) vulnerability. An attacker can deploy a web server that returns malicious content, and…EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2025-52656), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.