CVE•Published 2026-06-17•Modified 2026-06-26•0 articles on news•4 live references•NVD data

CVE-2025-59872Hcltech · Zie_for_web

Vulnerability data via NVD (ingested)

CVSS v3.1

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS percentile

Exploit Prediction Scoring System · top 74% of all CVEs

Weaknesses (CWE)

CWE-209Generation of Error Message Containing Sensitive Information CWE-434Unrestricted Upload of File with Dangerous Type

Description

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain command execution on the server by uploading a file known as a web shell, which allows you to execute arbitrary code or operating system commands. For this attack to be successful, the file needs to be uploaded inside the Webroot, and the server must be configured to execute the code

Timeline

Published 2026-06-17

Modified 2026-06-26

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2025-59872

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product + version

product:"Hcltech Zie For Web" version:"16.0"

Version-pinned fingerprint from NVD's first vulnerable CPE.

Shodan · banner/body mention

http.html:"Zie For Web"

HTTP body or banner mentions "Zie For Web" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2025-59872