Vulnerability · Published Oct 5, 2025 · Assigned by VulDB

CVE-2025-11279Axosoft Scrum and Bug Tracking Add Work Item csv injection

Medium 5.5

In plain English

A medium-severity injection in Scrum and Bug Tracking from Axosoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 85.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. This issue affects some unknown processing of the component Add Work Item Page. The manipulation of the argument Title results in csv injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Axosoft	Scrum and Bug Tracking	22.1.1.11545

Weakness: CWE-1236, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-327013 | Axosoft Scrum and Bug Tracking Add Work Item csv injection vdb-entry, technical-description
VDB-327013 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #659422 | Axosoft Scrum & Bug Tracking 22.1.1.11545 Improper Neutralization third-party-advisory
https://drive.google.com/file/d/1Lw9_KYblnhg7FQU70G0SgH_VyYRUD-rX/view?usp=sharing exploit