---
id: CVE-2025-31969
title: HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)
summary: >-
  HCL Unica Platform is impacted by misconfigured Content Security Policy
  (CSP).  These can result in malicious resources getting loaded and browsers
  may come across certain types of attacks, such as cross-site scripting and
  clickjacking.
severity: medium
cvss: 4
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L'
cwe:
  - CWE-358
vendor: hcltech
product: unica
affected:
  - unica <= 25.1.0
published: '2025-10-12'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-31969'
references:
  - url: >-
      https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417
    label: psirt@hcl.com
tags:
  - nvd
epss: 0.00164
epssPercentile: 0.05109
ingestedAt: '2026-10-08T13:42:55.117Z'
---

## Overview

HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.

## Affected

- `unica <= 25.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.