Vulnerability · Published Nov 25, 2025 · Assigned by HCL

CVE-2025-0248HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,

High 8.1

In plain English

A high-severity improper input validation in iNotes from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 65.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or steal the victim's cookie-based authentication credentials.

Affected products (as reported)

Vendor	Product	Versions
HCL Software	iNotes	<12.0.2 FP6, <14.0 FP4

Weakness: CWE-20, CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127032