CVE-2025-59847: HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session

Published Nov 11, 2026

Updated

HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session

Affected Software

1 affected component

HCL Domino Leap

Event History

Nov 11, 2026

CVE Published

via MITRE·07:48 AM

Data Sourced

via MITRE·07:48 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs high privileges and must be able to set a malicious application title. Exploitation is network-reachable, has low attack complexity, and requires a target user to interact with the affected Manage page dialog.

Which users are exposed to the stored script?

Users who open affected dialogs on the Manage page where a malicious application title is rendered may be exposed. Successful exploitation can allow the attacker to take over that user's session.

CVE-2025-59847: HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an attacker to take over a user's session

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which users are exposed to the stored script?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which users are exposed to the stored script?