CVE-2025-12249
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-27

Last updated on: 2026-04-29

Assigner: VulDB

Description
A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-27
Last Modified
2026-04-29
Generated
2026-06-16
AI Q&A
2025-10-27
EPSS Evaluated
2026-06-15
NVD
CVE-2025-12249
EUVD
EUVD-2025-36134
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
axosoft scrum_and_bug_tracking 22.1.1.11545
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Axosoft Scrum and Bug Tracking version 22.1.1.11545, specifically in the Edit Ticket Page component. It involves manipulation of the 'Title' argument which leads to CSV injection. This means an attacker can inject malicious content into CSV files generated or processed by the application. The attack can be initiated remotely, and the exploit is publicly available.

Impact Analysis

The CSV injection vulnerability can allow an attacker to execute malicious commands or scripts when a user opens a crafted CSV file generated by the application. This can lead to data compromise, unauthorized actions, or further exploitation of the system. Since the attack can be performed remotely, it increases the risk of unauthorized access or data manipulation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart