CVE-2023-37535 HIGH

CVE-2023-37535: HCL Domino Volt and Domino Leap are affected by a Cross-site scripting (XSS) vulnerability

Vendor Hcl Software
Product HCL Domino Leap
Weakness CWE-79 · XSS
Published April 30, 2025
Last update May 1, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

What the vulnerability does

01Description

Insufficient URI protocol whitelist in HCL Domino Volt and Domino Leap allow script injection through query parameters.

Key dates

02Disclosure timeline

April 30, 2025 CVE published
May 1, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-30315 Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2024-32571 WordPress WP Stripe Checkout plugin <= 1.2.2.41 - Cross Site Scripting (XSS) vulnerability CVE-2019-25398 IPFire 2.21 Core Update 127 Cross-Site Scripting via ovpnmain.cgi CVE-2025-34237 Advantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction() CVE-2024-13023 PHPGurukul Maid Hiring Management System Search Maid Page search-maid.php cross site scripting