BaseFortify

Publication date: 2025-10-09

Last updated on: 2025-10-22

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-09

Last Modified

2025-10-22

Generated

2026-07-06

AI Q&A

2025-10-09

EPSS Evaluated

2026-07-05

NVD

CVE-2025-35059

Affected Vendors & Products

Vendor	Product	Version / Range
newforma	project_center	to 2024.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated URL redirect in Newforma Info Exchange (NIX) at the '/DownloadWeb/hyperlinkredirect.aspx' endpoint. It occurs via the 'nhl' parameter, which allows an attacker to redirect users to arbitrary URLs without authentication.

Impact Analysis

This vulnerability can be used to redirect users to malicious websites, potentially leading to phishing attacks or other social engineering exploits. Since it does not require authentication, attackers can exploit it to trick users into visiting harmful sites, impacting user trust and security.

Hi! I’m here to help you understand CVE-2025-35059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70