PatchTheCVEproject center vulnerabilities and fixes
Recent CVEs affecting project center, with upgrade or downgrade steps. 14 tracked.
Also searched as: projectcenter.
project center has 14 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 12. Most recent: 2025-10-09. Highest priority: CVE-2025-35050 (score 54/100).
- CVE-2025-35050 CRITICAL 9.8 DOWNGRADE Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a
- CVE-2025-35051 CRITICAL 9.8 DOWNGRADE Newforma Project Center Server (NPCS) accepts serialized .NET data via the '/ProjectCenter.rem' endpoint on 90
- CVE-2025-35055 HIGH 8.8 UPGRADE Newforma Info Exchange (NIX) '/UserWeb/Common/UploadBlueimp.ashx' allows an authenticated attacker to upload a
- CVE-2025-35058 MEDIUM 5.9 UPGRADE Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' allows a remote, unauthenticated attacker t
- CVE-2025-35061 MEDIUM 5.9 UPGRADE Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated
- CVE-2025-35052 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) uses a hard-coded key to encrypt certain query parameters
- CVE-2025-35053 MEDIUM 6.4 UPGRADE Newforma Info Exchange (NIX) accepts requests to '/UserWeb/Common/MarkupServices.ashx' specifying the 'Downloa
- CVE-2025-35062 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an
- CVE-2025-35056 MEDIUM 5.0 UPGRADE Newforma Info Exchange (NIX) '/UserWeb/Common/MarkupServices.ashx' 'StreamStampImage' accepts an encrypted fil
- CVE-2025-35057 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) '/RemoteWeb/IntegrationServices.ashx' allows a remote, unauthenticated attacker t
- CVE-2025-35060 MEDIUM 5.5 UPGRADE Newforma Info Exchange (NIX) provides a 'Send a File Transfer' feature that allows a remote, authenticated att
- CVE-2025-35054 MEDIUM 5.3 UPGRADE Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma
- CVE-2025-35059 MEDIUM 4.3 UPGRADE Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect vi
- CVE-2024-32499 MEDIUM 4.9 UPGRADE Newforma Project Center Server through 2023.3.0.32259 allows remote code execution because .NET Remoting is ex
FAQ
How do I fix project center vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is project center being exploited right now?
None of the tracked project center CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which project center CVE should I patch first?
CVE-2025-35050 currently ranks highest (54/100): Newforma Info Exchange (NIX) accepts serialized .NET data via the '/remoteweb/remote.rem' endpoint, allowing a.