CVE-2025-35060CWE-79cross-site-scripting

CVE-2025-35060

Medium · published October 10, 2025

CVSS v3.1

5.5

EPSS

Percentile

11.3

In the wild

Unconfirmed

What it is

Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.

The record

Technical detail

CVSS v3.1: 5.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00215 · 11.3th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-10-10T01:15Z

Affected products (1)

Product	Versions	Fixed in
newforma/project_center	< 2024.1	2024.1

References (2)

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · 9119a7d8-5eab-497f-8521-727c672e3725 https://www.cve.org/CVERecord?id=CVE-2025-35060 · 9119a7d8-5eab-497f-8521-727c672e3725

EPSS history

Timeline

09 OCT 20:22Z
Newforma Info Exchange (NIX) stored XSS via SVG file upload
cvelistv5