rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-35029 Medical Informatics Engineering Enterprise Health stored cross site scripting via Demographic Information page
Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authenticated attacker to add arbitrary content in the 'Demographic Information' page. This content will be rendered and executed when a victim accesses it. This issue is fixed as of 2025-03-14.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Medical Informatics Engineering
product: Enterprise Health
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 3.5
attackVector: NETWORK
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: LOW
confidentialityImpact: NONE
Credits: lang: en
value: George Thompson, Sandia National Laboratories
lang: en
value: Trevor LaPay, Sandia National Laboratories
lang: en
value: Fernando Martinez, Sandia National Laboratories
lang: en
value: Gary Huang, Sandia National Laboratories
Published: 2025-11-20T19:34:31.465Z
CVE-2025-35030 Medical Informatics Engineering Enterprise Health cross site request forgery
Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Medical Informatics Engineering
product: Enterprise Health
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 8.1
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
integrityImpact: HIGH
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: George Thompson, Sandia National Laboratories
lang: en
value: Trevor LaPay, Sandia National Laboratories
lang: en
value: Fernando Martinez, Sandia National Laboratories
lang: en
value: Gary Huang, Sandia National Laboratories
Published: 2025-09-29T20:00:16.950Z
CVE-2025-35031 Medical Informatics Engineering Enterprise Health includes session token in debug output
Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08.
Problem types: cwe_id: CWE-1295
description: CWE-1295 Debug Messages Revealing Unnecessary Information
Affected products: vendor: Medical Informatics Engineering
product: Enterprise Health
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 3.3
attackVector: LOCAL
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
integrityImpact: NONE
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: LOW
Credits: lang: en
value: George Thompson, Sandia National Laboratories
lang: en
value: Trevor LaPay, Sandia National Laboratories
lang: en
value: Fernando Martinez, Sandia National Laboratories
lang: en
value: Gary Huang, Sandia National Laboratories
Published: 2025-09-29T20:00:42.546Z
CVE-2025-35032 Medical Informatics Engineering Enterprise Health arbitrary file upload
Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Medical Informatics Engineering
product: Enterprise Health
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 3.4
attackVector: NETWORK
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: HIGH
confidentialityImpact: NONE
Credits: lang: en
value: George Thompson, Sandia National Laboratories
lang: en
value: Trevor LaPay, Sandia National Laboratories
lang: en
value: Fernando Martinez, Sandia National Laboratories
lang: en
value: Gary Huang, Sandia National Laboratories
Published: 2025-09-29T20:01:09.311Z
CVE-2025-35033 Medical Informatics Engineering Enterprise Health CSV injection
Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.
Problem types: cwe_id: CWE-1236
description: CWE-1236 Improper Neutralization of Formula Elements in a CSV File
Affected products: vendor: Medical Informatics Engineering
product: Enterprise Health
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 4.1
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: LOW
confidentialityImpact: NONE
Credits: lang: en
value: George Thompson, Sandia National Laboratories
lang: en
value: Trevor LaPay, Sandia National Laboratories
lang: en
value: Fernando Martinez, Sandia National Laboratories
lang: en
value: Gary Huang, Sandia National Laboratories
Published: 2025-09-29T20:01:38.144Z
CVE-2025-35034 Medical Informatics Engineering Enterprise Health reflected cross site scripting via portlet_user_id
Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Medical Informatics Engineering
product: Enterprise Health
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 4.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: NONE
Credits: lang: en
value: George Thompson, Sandia National Laboratories
lang: en
value: Trevor LaPay, Sandia National Laboratories
lang: en
value: Fernando Martinez, Sandia National Laboratories
lang: en
value: Gary Huang, Sandia National Laboratories
Published: 2025-09-29T20:01:58.419Z
CVE-2025-35036 hibernate-validator insecure default Expression Language interpolation
Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no longer interpolates custom constraint violation messages with Expression Language and strongly recommends not allowing user-supplied input in constraint violation messages. CVE-2020-5245 and CVE-2025-4428 are examples of related, downstream vulnerabilities involving Expression Language intepolation of user-supplied data.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Hibernate
product: Hibernate Validator
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 7.3
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
integrityImpact: LOW
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: NONE
confidentialityImpact: LOW
Published: 2025-06-03T19:27:42.900Z
CVE-2025-35041 Airship AI Acropolis MFA insufficient rate limiting
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.
Problem types: cwe_id: CWE-307
description: CWE-307 Improper Restriction of Excessive Authentication Attempts
Affected products: vendor: Airship AI
product: Acropolis
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 7.5
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: HIGH
availabilityImpact: HIGH
privilegesRequired: LOW
confidentialityImpact: HIGH
Credits: lang: en
value: Zach Crosman, CISA
Published: 2025-09-22T15:56:38.084Z
CVE-2025-35042 Airship AI Acropolis default credentials
Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account password are vulnerable to a remote attacker logging in and gaining the privileges of this account. Fixed in 10.2.35, 11.0.21, and 11.1.9.
Problem types: cwe_id: CWE-1392
description: CWE-1392 Use of Default Credentials
Affected products: vendor: Airship AI
product: Acropolis
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Zach Crosman, CISA
Published: 2025-09-22T15:57:03.528Z
CVE-2025-35050 Newforma Info Exchange (NIX) .NET unauthenticated deserialization
Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma Project Center Server (NPCS), so a compromised NIX system can be used to attack an associated NPCS system. To mitigate this vulnerability, restrict network access to the '/remoteweb/remote.rem' endpoint, for example using the IIS URL Rewrite Module.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:19:12.867Z
CVE-2025-35051 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommended architecture, the vulnerable NPCS endpoint is only accessible on an internal network. To mitigate this vulnerability, restrict network access to NPCS.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 9.8
attackVector: NETWORK
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:19:43.826Z
CVE-2025-35052 Newforma Info Exchange (NIX) shared hard-coded secret key
Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the 'qs' parameter used in '/DownloadWeb/download.aspx'. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: LOW
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:20:00.632Z
CVE-2025-35053 Newforma Info Exchange (NIX) arbitrary file read and delete
Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'DownloadExportedPDF' command that allow an authenticated user to read and delete arbitrary files with 'NT AUTHORITY\NetworkService' privileges.

In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-73
description: CWE-73 External Control of File Name or Path
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 6.4
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:20:18.008Z
CVE-2025-35054 Newforma Info Exchange (NIX) insufficiently protected credentials
Newforma Info Exchange (NIX) stores credentials  used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources.
Problem types: cwe_id: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
cwe_id: CWE-257
description: CWE-257 Storing Passwords in a Recoverable Format
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.3
attackVector: LOCAL
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
integrityImpact: LOW
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:20:40.025Z
CVE-2025-35055 Newforma Info Exchange (NIX) insecure file upload
Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run a web shell or other content executable by the web server. An attacker can also delete directories.  In Newforma before 2023.1, anonymous access is enabled by default (CVE-2025-35062), allowing an otherwise unauthenticated attacker to effectively authenticate as 'anonymous' and exploit this file upload vulnerability.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 8.8
attackVector: NETWORK
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
integrityImpact: HIGH
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: HIGH
privilegesRequired: LOW
confidentialityImpact: HIGH
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:20:56.432Z
CVE-2025-35056 Newforma Info Exchange (NIX) limited file read
Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path and returns an image of the specified file. An authenticated attacker can read arbitrary files subject to the privileges of NIX, typically 'NT AUTHORITY\NetworkService', and the ability of StreamStampImage to process the file. The encrypted file path can be generated using the shared, hard-coded secret key described in CVE-2025-35052. This vulnerability cannot be exploited as an 'anonymous' user as described in CVE-2025-35062.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: CHANGED
version: 3.1
baseScore: 5
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:21:10.405Z
CVE-2025-35057 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashx
Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the NIX service account.
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: HIGH
availabilityImpact: NONE
privilegesRequired: LOW
confidentialityImpact: HIGH
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:21:29.071Z
CVE-2025-35058 Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the customer-configured NIX service account.
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.9
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
integrityImpact: NONE
userInteraction: NONE
attackComplexity: HIGH
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: HIGH
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:21:43.176Z
CVE-2025-35059 Newforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspx
Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 4.3
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: NONE
privilegesRequired: NONE
confidentialityImpact: NONE
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:21:56.759Z
CVE-2025-35060 Newforma Info Exchange (NIX) stored XSS via SVG file upload
Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Newforma
product: Project Center
default_status: unknown
CVSS v3.1: scope: UNCHANGED
version: 3.1
baseScore: 5.5
attackVector: NETWORK
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
integrityImpact: LOW
userInteraction: REQUIRED
attackComplexity: LOW
availabilityImpact: LOW
privilegesRequired: LOW
confidentialityImpact: LOW
Credits: lang: en
value: Shadron Gudmunson,Luke Rindels,Robert McCain,Asjha Stus,Adam Merrill,Ryan Kao,Brian Healy, Sandia National Laboratories Adversarial Modeling and Penetration Testing (AMPT)
Published: 2025-10-09T20:22:10.025Z