CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| MITTEL6.1 |
Multiple vectors in HCL Leap allow client-side
script injection in the authoring environment and deployed applications. |
| 24/04/2025 |
| CVE-2024-30114 | MITTEL5.4 | Insufficient sanitization in HCL Leap allows
client-side script injection in the authoring environment. | 24/04/2025 |
| CVE-2024-30113 | MITTEL5.4 | Insufficient sanitization policy in HCL Leap
allows client-side script injection in the deployed application through the
HTML widget. | 24/04/2025 |
| CVE-2023-45720 | MITTEL5.3 | Insufficient default configuration in HCL Leap
allows anonymous access to directory information. | 24/04/2025 |
| CVE-2023-37534 | MITTEL6.1 | Insufficient URI protocol whitelist in HCL Leap
allows script injection through query parameters. | 24/04/2025 |
| CVE-2024-30148 | MITTEL4.1 | Improper access control of endpoint in HCL Leap
allows certain admin users to import applications from the
server's filesystem. | 24/04/2025 |
| CVE-2022-38657 | MITTEL5.4 | An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
| 12/02/2023 |