CVE-2025-11279

MEDIUM

Axosoft Scrum and Bug Tracking 22.1.1.11545 - CSV Injection

Title source: llm

Description

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. The manipulation of the argument Title results in csv injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

[Permissions Required, VDB Entry] https://vuldb.com/?id.327013

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.327013

[Permissions Required, VDB Entry] https://vuldb.com/?submit.659422

[Various Sources] https://drive.google.com/file/d/1Lw9_KYblnhg7FQU70G0SgH_VyYRUD-rX/view?usp=sharing

Scores

CVSS v3 5.5

EPSS 0.0004

EPSS Percentile 10.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-1236 CWE-74

Status published

Products (1)

Axosoft/Scrum and Bug Tracking 22.1.1.11545

Published Oct 05, 2025

Tracked Since Feb 18, 2026