CVE-2025-35051

🗓️ 09 Oct 2025 20:19:43Reported by cisa-cgType

cve🔗 web.nvd.nist.gov👁 17 Views🌐 WEB

Newforma NPCS exposes unauthenticated .NET deserialization on /ProjectCenter.rem enabling code execution.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-35051	9 Jan 202619:04	–	circl
CNNVD	Newforma Project Center Server 安全漏洞	9 Oct 202500:00	–	cnnvd
CNVD	Newforma Project Center Server Code Execution Vulnerability	21 Oct 202500:00	–	cnvd
Cvelist	CVE-2025-35051 Newforma Project Center Server (NPCS) .NET unauthenticated deserialization	9 Oct 202520:19	–	cvelist
EUVD	EUVD-2025-33576	9 Oct 202521:31	–	euvd
NVD	CVE-2025-35051	9 Oct 202521:15	–	nvd
OSV	CVE-2025-35051	9 Oct 202521:15	–	osv
Positive Technologies	PT-2025-41467	9 Oct 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-35051	10 Oct 202520:22	–	redhatcve
ICS	Newforma Project Center multiple vulnerabilities	9 Oct 202519:50	–	ics

NVD

Node

newforma project_centerMatch2024.3

[
  {
    "vendor": "Newforma",
    "product": "Project Center",
    "defaultStatus": "unknown",
    "versions": [
      {
        "version": "*",
        "status": "affected"
      },
      {
        "version": "2024.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
cve	www.cve.org/CVERecord
projectcenter	www.projectcenter.help.newforma.com/overviews/info_exchange_overview/
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json

Parameter	Position	Path	Description	CWE
serialized_data	request body	9003/ProjectCenter.rem	Endpoint accepts serialized .NET data enabling remote code execution via untrusted input.	CWE-306, CWE-502

26 Apr 2026 19:04Current

7.6High risk

Vulners AI Score7.6

CVSS 49.2

CVSS 3.19.8

EPSS0.00327

SSVC