CVE-2025-59873 - CVE House
Back to Database
Status published Medium CVE-2025-59873

Session Token Exposure via URL Query Parameters

Vulnerability Description

An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions This issue affects ZIE for Web: v16.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59873

Credits & Attribution

No credits recorded in the NVD database.

References

More from HCL Software

View All →
CVE-2025-62346
HCL Glovius Cloud is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability
Medium 6.8
CVE-2025-62340
HCL iControl was affected by Inadequate Session Timeout vulnerability
Low 3.1
CVE-2025-62330
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information
Medium 5.9
CVE-2025-62329
HCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerability
Medium 5
CVE-2025-59872
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,
Medium 4.3

Affected Vendor

HCL Software

View all reports →

Affected Software

ZIE for Web
Vulnerable Versions:
v16

Timeline

Official Publish: February 23rd, 2026
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.