Advisories · Technology

Newforma Project Center.

Every CVE that names Newforma Project Center among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-35061 CVE record

CVSS 8.2 High

Newforma Info Exchange (NIX) forced NTLMv2 authentication via /NPCSRemoteWeb/LegacyIntegrationServices.asmx
- Newforma Project Center
- Authentication bypass
Not analysed yet 9 Oct 2025
CVE-2025-35062 CVE record

CVSS 6.9 Medium

Newforma Info Exchange (NIX) default anonymous access
- Newforma Project Center
- Broken access control
Not analysed yet 9 Oct 2025
CVE-2025-35060 CVE record

CVSS 5.1 Medium

Newforma Info Exchange (NIX) stored XSS via SVG file upload
- Newforma Project Center
- Cross-site scripting (XSS)
Not analysed yet 9 Oct 2025
CVE-2025-35059 CVE record

CVSS 5.3 Medium

Newforma Info Exchange (NIX) open URL redirect via /DownloadWeb/hyperlinkredirect.aspx
- Newforma Project Center
- Open redirect
Not analysed yet 9 Oct 2025
CVE-2025-35058 CVE record

CVSS 8.2 High

Newforma Info Exchange (NIX) forced NTLMv2 authentication via /UserWeb/Common/MarkupServices.ashx
- Newforma Project Center
- Authentication bypass
Not analysed yet 9 Oct 2025
CVE-2025-35057 CVE record

CVSS 6.0 Medium

Newforma Info Exchange (NIX) forced NTLMv2 authentication via /RemoteWeb/IntegrationServices.ashx
- Newforma Project Center
- Authentication bypass
Not analysed yet 9 Oct 2025
CVE-2025-35056 CVE record

CVSS 5.3 Medium

Newforma Info Exchange (NIX) limited file read
- Newforma Project Center
- Path traversal
Not analysed yet 9 Oct 2025
CVE-2025-35055 CVE record

CVSS 8.7 High

Newforma Info Exchange (NIX) insecure file upload
- Newforma Project Center
- Path traversal
- Unrestricted file upload
Not analysed yet 9 Oct 2025
CVE-2025-35054 CVE record

CVSS 4.8 Medium

Newforma Info Exchange (NIX) insufficiently protected credentials
- Newforma Project Center
- Hard-coded credentials
- Information disclosure
Not analysed yet 9 Oct 2025
CVE-2025-35053 CVE record

CVSS 6.1 Medium

Newforma Info Exchange (NIX) arbitrary file read and delete
- Newforma Project Center
- Path traversal
Not analysed yet 9 Oct 2025
CVE-2025-35052 CVE record

CVSS 6.3 Medium

Newforma Info Exchange (NIX) shared hard-coded secret key
- Newforma Project Center
- Hard-coded credentials
Not analysed yet 9 Oct 2025
CVE-2025-35051 CVE record

CVSS 7.7 High

Newforma Project Center Server (NPCS) .NET unauthenticated deserialization
- Newforma Project Center
- Authentication bypass
- Insecure deserialization
Not analysed yet 9 Oct 2025
CVE-2025-35050 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Newforma Info Exchange (NIX) .NET unauthenticated deserialization
- Newforma Project Center
- Authentication bypass
- Insecure deserialization
Not analysed yet 9 Oct 2025