Newforma vulnerabilities
We track 4 vulnerabilities in Newforma products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2025.
Latest Newforma vulnerabilities
- 9.8 Critical severity
Project Center: Incorrect Default Permissions
Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.
- 8.8 High severity
Project Center: Improper Limitation of a Pathname to a Restricted Directory
Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload an arbitrary file to any location writable by the NIX application. An attacker can upload and run a web shell or other content executable by the web se
- 9.8 Critical severity
Project Center: Missing Authentication for Critical Functionality
Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 9003/tcp, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. According to the recommen
- 9.8 Critical severity
Project Center: Missing Authentication for Critical Functionality
Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a remote, unauthenticated attacker to execute arbitrary code with 'NT AUTHORITY\NetworkService' privileges. The vulnerable endpoint is used by Newforma