PT-2025-43906 · Axosoft · Axosoft Scrum/Bug Tracking

Sn4Ku1 · Published 2025-10-27 · Updated 2025-10-27 · CVE-2025-12249

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Axosoft Scrum and Bug Tracking version 22.1.1.11545

Description A flaw exists in Axosoft Scrum and Bug Tracking that allows for CSV injection. The issue is located in the Edit Ticket Page component, specifically through manipulation of the Title argument. This can be exploited remotely. The exploit is publicly available. The vendor was notified but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Special Elements Injection

Weakness Enumeration

CWE-1236

CWE-74

Related Identifiers

CVE-2025-12249

Affected Products

Axosoft Scrum/Bug Tracking

References · 7

• 🔥 https://drive.google.com/file/d/1EtmG4IyNQO7VStycpkSl9iivURrYQBSD/view?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12249 · Security Note
• https://vuldb.com/?id.329920 · Note
• https://vuldb.com/?ctiid.329920 · Note
• https://t.me/cveNotify/140415 · Telegram Post
• https://vuldb.com/?submit.673851 · Note
• https://t.me/CVEtracker/35809 · Telegram Post