CVE-2025-59848: HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session

Published Nov 11, 2026

Updated

HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session

Affected Software

1 affected component

HCL Leap

Event History

Nov 11, 2026

CVE Published

via MITRE·07:41 AM

Data Sourced

via MITRE·07:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs high privileges and must be able to set a malicious application title. Exploitation also requires a user to interact with the affected Manage page dialogs.

What is the likely impact if exploitation succeeds?

The stored script can enable takeover of the affected user's session. The provided severity vector rates confidentiality, integrity, and availability impact as high.

How can teams identify potentially affected content?

Review application titles in HCL Leap for unexpected or suspicious markup or script-like content, particularly for applications surfaced through Manage page dialogs. The issue is stored XSS in application titles.

CVE-2025-59848: HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an attacker to take over a user's session

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

How can teams identify potentially affected content?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

How can teams identify potentially affected content?