BaseFortify

Publication date: 2025-10-27

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12249

EUVD

EUVD-2025-36134

Affected Vendors & Products

Vendor	Product	Version / Range
axosoft	scrum_and_bug_tracking	22.1.1.11545

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1236	The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Axosoft Scrum and Bug Tracking version 22.1.1.11545, specifically in the Edit Ticket Page component. It involves manipulation of the 'Title' argument which leads to CSV injection. This means an attacker can inject malicious content into CSV files generated or processed by the application. The attack can be initiated remotely, and the exploit is publicly available.

Impact Analysis

The CSV injection vulnerability can allow an attacker to execute malicious commands or scripts when a user opens a crafted CSV file generated by the application. This can lead to data compromise, unauthorized actions, or further exploitation of the system. Since the attack can be performed remotely, it increases the risk of unauthorized access or data manipulation.

Hi! I’m here to help you understand CVE-2025-12249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70