CVE-2025-11279

MediumCVSS 5.5

Published: 05/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

12th percentile - higher than 12% of all known CVEs

Summary

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. It affects unknown processing in the Add Work Item Page component, where manipulation of the Title argument results in CSV injection. The attack can be launched remotely, and the exploit is now public.

Risk Assessment

The risk involves the possibility of remote exploitation by an attacker, which could lead to injection of malicious CSV data and potential compromise of data integrity or further attacks on users.

Recommendation

It is recommended to immediately apply available patches or update the Axosoft software, and to monitor public exploits and implement mitigations to reduce the risk of CSV injection.

Other vulnerabilities in Axosoft Scrum and Bug Tracking

CVE-2025-12249Medium
A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Original NVD description (English source)

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. The manipulation of the argument Title results in csv injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS