{"schema_version":1,"title":"Newforma Project Center vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 13 vulnerabilities in Newforma Project Center: 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2025-35062, was published on 9 October 2025.","url":"https://junglewise.ai/threats/technologies/project-center","json_url":"https://junglewise.ai/threats/technologies/project-center.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/project-center","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":1,"all_time":13,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":0},"latest":[{"cve":"CVE-2025-35062","cvss":5.3,"epss":0.0037,"slug":"cve-2025-35062-newforma-info-exchange-nix-before-version-2023-1-by-default","title":"Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:37.607+00:00","url":"https://junglewise.ai/threats/cve-2025-35062-newforma-info-exchange-nix-before-version-2023-1-by-default"},{"cve":"CVE-2025-35061","cvss":5.9,"epss":0.0038,"slug":"cve-2025-35061-newforma-info-exchange-nix-npcsremoteweb","title":"Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:37.46+00:00","url":"https://junglewise.ai/threats/cve-2025-35061-newforma-info-exchange-nix-npcsremoteweb"},{"cve":"CVE-2025-35060","cvss":5.5,"epss":0.0022,"slug":"cve-2025-35060-newforma-info-exchange-nix-provides-a-send-a-file-transfer","title":"Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:37.297+00:00","url":"https://junglewise.ai/threats/cve-2025-35060-newforma-info-exchange-nix-provides-a-send-a-file-transfer"},{"cve":"CVE-2025-35059","cvss":4.3,"epss":0.0021,"slug":"cve-2025-35059-newforma-info-exchange-nix-downloadweb-hyperlinkredirect-aspx","title":"Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter.","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:37.143+00:00","url":"https://junglewise.ai/threats/cve-2025-35059-newforma-info-exchange-nix-downloadweb-hyperlinkredirect-aspx"},{"cve":"CVE-2025-35058","cvss":5.9,"epss":0.0038,"slug":"cve-2025-35058-newforma-info-exchange-nix-userweb-common-markupservices-ashx","title":"Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.983+00:00","url":"https://junglewise.ai/threats/cve-2025-35058-newforma-info-exchange-nix-userweb-common-markupservices-ashx"},{"cve":"CVE-2025-35057","cvss":5.3,"epss":0.0033,"slug":"cve-2025-35057-newforma-info-exchange-nix-remoteweb-integrationservices-ashx","title":"Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.827+00:00","url":"https://junglewise.ai/threats/cve-2025-35057-newforma-info-exchange-nix-remoteweb-integrationservices-ashx"},{"cve":"CVE-2025-35056","cvss":5,"epss":0.0035,"slug":"cve-2025-35056-newforma-info-exchange-nix-userweb-common-markupservices-ashx","title":"Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted file path…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.67+00:00","url":"https://junglewise.ai/threats/cve-2025-35056-newforma-info-exchange-nix-userweb-common-markupservices-ashx"},{"cve":"CVE-2025-35055","cvss":8.8,"epss":0.0054,"slug":"cve-2025-35055-newforma-info-exchange-nix-userweb-common-uploadblueimp-ashx","title":"Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an…","severity":"high","exploited":false,"published_at":"2025-10-09T21:15:36.517+00:00","url":"https://junglewise.ai/threats/cve-2025-35055-newforma-info-exchange-nix-userweb-common-uploadblueimp-ashx"},{"cve":"CVE-2025-35054","cvss":5.3,"epss":0.0008,"slug":"cve-2025-35054-newforma-info-exchange-nix-stores-credentials-used-to-configure","title":"Newforma Info Exchange (NIX) stores credentials used to configure NPCS in…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.357+00:00","url":"https://junglewise.ai/threats/cve-2025-35054-newforma-info-exchange-nix-stores-credentials-used-to-configure"},{"cve":"CVE-2025-35053","cvss":6.4,"epss":0.0041,"slug":"cve-2025-35053-newforma-info-exchange-nix-accepts-requests-to-userweb-common","title":"Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.203+00:00","url":"https://junglewise.ai/threats/cve-2025-35053-newforma-info-exchange-nix-accepts-requests-to-userweb-common"},{"cve":"CVE-2025-35052","cvss":5.3,"epss":0.0037,"slug":"cve-2025-35052-newforma-info-exchange-nix-uses-a-hard-coded-key-to-encrypt","title":"Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.04+00:00","url":"https://junglewise.ai/threats/cve-2025-35052-newforma-info-exchange-nix-uses-a-hard-coded-key-to-encrypt"},{"cve":"CVE-2025-35051","cvss":9.8,"epss":0.0084,"slug":"cve-2025-35051-newforma-project-center-server-npcs-accepts-serialized-net-data","title":"Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp…","severity":"critical","exploited":false,"published_at":"2025-10-09T21:15:35.873+00:00","url":"https://junglewise.ai/threats/cve-2025-35051-newforma-project-center-server-npcs-accepts-serialized-net-data"},{"cve":"CVE-2025-35050","cvss":9.8,"epss":0.0092,"slug":"cve-2025-35050-newforma-info-exchange-nix-accepts-serialized-net-data-via-the","title":"Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote…","severity":"critical","exploited":false,"published_at":"2025-10-09T21:15:35.707+00:00","url":"https://junglewise.ai/threats/cve-2025-35050-newforma-info-exchange-nix-accepts-serialized-net-data-via-the"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Newforma Project Center","slug":"project-center","vendor":{"hub":true,"name":"Newforma","slug":"newforma","url":"https://junglewise.ai/threats/vendors/newforma"},"aliases":[],"homepage":"https://www.newforma.com/","description":"Newforma project management software for construction and design firms.","url":"https://junglewise.ai/threats/technologies/project-center"},"most_severe":[{"cve":"CVE-2025-35050","cvss":9.8,"epss":0.0092,"slug":"cve-2025-35050-newforma-info-exchange-nix-accepts-serialized-net-data-via-the","title":"Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote…","severity":"critical","exploited":false,"published_at":"2025-10-09T21:15:35.707+00:00","url":"https://junglewise.ai/threats/cve-2025-35050-newforma-info-exchange-nix-accepts-serialized-net-data-via-the"},{"cve":"CVE-2025-35051","cvss":9.8,"epss":0.0084,"slug":"cve-2025-35051-newforma-project-center-server-npcs-accepts-serialized-net-data","title":"Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp…","severity":"critical","exploited":false,"published_at":"2025-10-09T21:15:35.873+00:00","url":"https://junglewise.ai/threats/cve-2025-35051-newforma-project-center-server-npcs-accepts-serialized-net-data"},{"cve":"CVE-2025-35055","cvss":8.8,"epss":0.0054,"slug":"cve-2025-35055-newforma-info-exchange-nix-userweb-common-uploadblueimp-ashx","title":"Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an…","severity":"high","exploited":false,"published_at":"2025-10-09T21:15:36.517+00:00","url":"https://junglewise.ai/threats/cve-2025-35055-newforma-info-exchange-nix-userweb-common-uploadblueimp-ashx"},{"cve":"CVE-2025-35053","cvss":6.4,"epss":0.0041,"slug":"cve-2025-35053-newforma-info-exchange-nix-accepts-requests-to-userweb-common","title":"Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.203+00:00","url":"https://junglewise.ai/threats/cve-2025-35053-newforma-info-exchange-nix-accepts-requests-to-userweb-common"},{"cve":"CVE-2025-35061","cvss":5.9,"epss":0.0038,"slug":"cve-2025-35061-newforma-info-exchange-nix-npcsremoteweb","title":"Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:37.46+00:00","url":"https://junglewise.ai/threats/cve-2025-35061-newforma-info-exchange-nix-npcsremoteweb"},{"cve":"CVE-2025-35058","cvss":5.9,"epss":0.0038,"slug":"cve-2025-35058-newforma-info-exchange-nix-userweb-common-markupservices-ashx","title":"Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker to cause…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.983+00:00","url":"https://junglewise.ai/threats/cve-2025-35058-newforma-info-exchange-nix-userweb-common-markupservices-ashx"},{"cve":"CVE-2025-35060","cvss":5.5,"epss":0.0022,"slug":"cve-2025-35060-newforma-info-exchange-nix-provides-a-send-a-file-transfer","title":"Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated attacker to…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:37.297+00:00","url":"https://junglewise.ai/threats/cve-2025-35060-newforma-info-exchange-nix-provides-a-send-a-file-transfer"},{"cve":"CVE-2025-35062","cvss":5.3,"epss":0.0037,"slug":"cve-2025-35062-newforma-info-exchange-nix-before-version-2023-1-by-default","title":"Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:37.607+00:00","url":"https://junglewise.ai/threats/cve-2025-35062-newforma-info-exchange-nix-before-version-2023-1-by-default"},{"cve":"CVE-2025-35052","cvss":5.3,"epss":0.0037,"slug":"cve-2025-35052-newforma-info-exchange-nix-uses-a-hard-coded-key-to-encrypt","title":"Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters. Some encrypted parameter…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.04+00:00","url":"https://junglewise.ai/threats/cve-2025-35052-newforma-info-exchange-nix-uses-a-hard-coded-key-to-encrypt"},{"cve":"CVE-2025-35057","cvss":5.3,"epss":0.0033,"slug":"cve-2025-35057-newforma-info-exchange-nix-remoteweb-integrationservices-ashx","title":"Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker to cause…","severity":"medium","exploited":false,"published_at":"2025-10-09T21:15:36.827+00:00","url":"https://junglewise.ai/threats/cve-2025-35057-newforma-info-exchange-nix-remoteweb-integrationservices-ashx"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}