Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2025-35060

Newforma Info Exchange (NIX) stored XSS via SVG file upload

Description

Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to upload SVG files that contain JavaScript or other content that may be executed or rendered by a web browser using a mobile user agent.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Newforma Project Center

Default version status: unknown

  • 0 to < 2024.1affected
  • 2024.1unaffected

References