CVE-2025-31966
Received Received - Intake

Broken Server-Side Validation in HCL Sametime Enables Bypass

Publication date: 2026-03-17

Last updated on: 2026-03-31

Assigner: HCL Software

Description
HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced by the web server. An attacker can bypass these restrictions by sending manipulated HTTP requests directly to the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-17
Last Modified
2026-03-31
Generated
2026-07-06
AI Q&A
2026-03-17
EPSS Evaluated
2026-07-05
NVD
CVE-2025-31966
EUVD
EUVD-2025-208777

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcltech sametime to 12.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in HCL Sametime involves broken server-side validation. Although the application performs input checks on the client side, these checks are not enforced by the web server itself.

This means an attacker can bypass the client-side restrictions by sending manipulated HTTP requests directly to the server, potentially exploiting the lack of proper validation on the server side.

Impact Analysis

This vulnerability can impact you by allowing an attacker with high privileges to send crafted HTTP requests that bypass client-side validation, potentially leading to unauthorized or unintended actions within the HCL Sametime application.

According to the CVSS score (2.7), the impact on confidentiality is none, but there is a low impact on integrity, meaning the attacker could alter data or behavior in a limited way without affecting availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-31966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart