CVE-2025-35062

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-35086.5Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to v CVE-2025-35097.2A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by e CVE-2025-35105.4The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and inc CVE-2025-35117.5Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Lin CVE-2025-351124.9Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attac CVE-2025-351137.2Agiloft Release 28 does not properly neutralize special elements used in an EUI template engine, allowing an authenticated attacker to achie CVE-2025-351147.5Agiloft Release 28 contains several accounts with default credentials that could allow local privilege escalation. The password hash is know CVE-2025-351158.1Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could re CVE-2025-35124.8There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be pas CVE-2025-35133.5The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users CVE-2025-35143.5The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users CVE-2025-35159.8The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient f