The vulnerability stems from improper input sanitation in HCL Digital Experience, allowing attackers to inject arbitrary HTML into rendered pages. This flaw can lead to content spoofing, whereby malicious actors fake trustworthy content from the same domain. The issue is classified as CWE-79 and represents a moderate risk to the integrity and trustworthiness of the platform.

Impact: HCL Digital Experience from HCLSoftware is affected, with the flaw present prior to version 9.5 CF238. The vendor recommends applying HCL Digital Experience 9.5 CF238 or newer to resolve the issue.

The CVSS score is 6.5, indicating a moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw from a web‑based vector, submitting malicious input through exposed form fields or other user‑driven entry points. Since no special conditions are specified, any user with access to the application can potentially exploit it, making the risk moderate.