Threats Tagged 'cve-2025-35060'

CVE-2025-35060 is a medium-severity cross-site scripting (XSS) vulnerability in Newforma Project Center's Info Exchange feature. It allows a remote, authenticated attacker to upload SVG files containing malicious JavaScript, which can be executed when viewed on mobile browsers. The vulnerability arises from improper input neutralization during web page generation, specifically in handling SVG file uploads. Exploitation requires authentication and some user interaction to trigger the malicious payload. While no known exploits are currently reported in the wild, the vulnerability poses risks to confidentiality, integrity, and availability of user sessions and data. European organizations using Newforma Project Center, especially those in architecture, engineering, and construction sectors, should prioritize mitigation. Practical defenses include restricting SVG uploads, sanitizing SVG content, enforcing strict Content Security Policies, and monitoring user activity. Countries with significant adoption of Newforma products and critical infrastructure projects, such as Germany, the UK, France, and the Netherlands, are most likely to be affected. Given the medium CVSS score of 5.1, the threat requires attention but is not critical.

MediumVulnerabilityGermanyFranceNetherlands+4#cve#cve-2025-35060#cwe-79