A cross‑domain script include flaw in HCL Aftermarket DPC lets an attacker supply or host malicious external scripts that the application loads. Once executed, the script can alter the Document Object Model, enabling the theft of cookies or session tokens and resulting in the hijacking of user sessions. The vulnerability disrupts the confidentiality and integrity of session state and permits unauthorized access to user data.

The affected product is HCL Aftermarket DPC, version 1.0.0. No other vendors or products were listed as impacted by this entry.

The CVSS base score of 4.3 indicates moderate severity. An EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector relies on an attacker hosting or supplying external scripts that the application includes, allowing the malicious code to read cookies or other sensitive data. Exploitation requires the attacker to provide a suitable script and get the application to load it; once executed, session hijacking occurs without direct server‑side code execution.