CVE-2025-35059
BaseFortify
Publication date: 2025-10-09
Last updated on: 2025-10-22
Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| newforma | project_center | to 2024.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unauthenticated URL redirect in Newforma Info Exchange (NIX) at the '/DownloadWeb/hyperlinkredirect.aspx' endpoint. It occurs via the 'nhl' parameter, which allows an attacker to redirect users to arbitrary URLs without authentication.
How can this vulnerability impact me? :
This vulnerability can be used to redirect users to malicious websites, potentially leading to phishing attacks or other social engineering exploits. Since it does not require authentication, attackers can exploit it to trick users into visiting harmful sites, impacting user trust and security.