CVE-2025-11279
Axosoft Scrum and Bug Tracking Add Work Item csv injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Oct 5, 2025
- Updated
- Oct 6, 2025
- Reserved
- Oct 4, 2025
Description
A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. The manipulation of the argument Title results in csv injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.5 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Scrum and Bug TrackingAxosoft |
|
References
- VDB-327013 | Axosoft Scrum and Bug Tracking Add Work Item csv injectionvdb-entrytechnical-description
- VDB-327013 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #659422 | Axosoft Scrum & Bug Tracking 22.1.1.11545 Improper Neutralizationthird-party-advisory
- https://drive.google.com/file/d/1Lw9_KYblnhg7FQU70G0SgH_VyYRUD-rX/view?usp=sharingexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.