CVE-2025-31966
Received Received - Intake
Broken Server-Side Validation in HCL Sametime Enables Bypass

Publication date: 2026-03-17

Last updated on: 2026-03-31

Assigner: HCL Software

Description
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-17
Last Modified
2026-03-31
Generated
2026-06-16
AI Q&A
2026-03-17
EPSS Evaluated
2026-06-15
NVD
CVE-2025-31966
EUVD
EUVD-2025-208777
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
hcltech sametime to 12.0.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in HCL Sametime involves broken server-side validation. Although the application performs input checks on the client side, these checks are not enforced by the web server itself.

This means an attacker can bypass the client-side restrictions by sending manipulated HTTP requests directly to the server, potentially exploiting the lack of proper validation on the server side.

Impact Analysis

This vulnerability can impact you by allowing an attacker with high privileges to send crafted HTTP requests that bypass client-side validation, potentially leading to unauthorized or unintended actions within the HCL Sametime application.

According to the CVSS score (2.7), the impact on confidentiality is none, but there is a low impact on integrity, meaning the attacker could alter data or behavior in a limited way without affecting availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-31966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart