CVE-2025-35052

MEDIUM 5.3CVE-2025-35052 · Published 09/10/2025 · updated 08/10/2026

In short

CVE-2025-35052 is a MEDIUM (CVSS 5.3) vulnerability affecting project center (newforma).
Chance of exploitation in the next 30 days (EPSS): 0.37%, higher than 30.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
project center newforma	`≤ 2024.3`	No fix yet

Description

Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter values can specify paths to download files, potentially bypassing authentication and authorization, for example, the 'qs' parameter used in '/DownloadWeb/download.aspx'. This key is shared across NIX installations. NIX 2023.3 and 2024.1 limit the use of hard-coded keys.

References

raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json · Third Party Advisory
cve.org/CVERecord · Third Party Advisory

More vulnerabilities in project center

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

project center

newforma

≤ 2024.3

No fix yet

Description

More vulnerabilities in project center

See all →