Vulnerability · Published Oct 27, 2025 · Assigned by VulDB

CVE-2025-12249Axosoft Scrum and Bug Tracking Edit Ticket csv injection

Medium 6.3

In plain English

A medium-severity injection in Scrum and Bug Tracking from Axosoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Axosoft	Scrum and Bug Tracking	22.1.1.11545

Weakness: CWE-1236, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-329920 | Axosoft Scrum and Bug Tracking Edit Ticket csv injection vdb-entry, technical-description
VDB-329920 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #673851 | Axosoft Scrum and Bug Tracking 22.1.1.11545 Improper Neutralization third-party-advisory
https://drive.google.com/file/d/1EtmG4IyNQO7VStycpkSl9iivURrYQBSD/view?usp=sharing exploit