MEDIUM🇬🇧 English

CVE-2025-11018

CVSS 5.5v4.0pub. 2025-09-26upd. 2025-10-08

A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Four Faith Water Conservancy Informatization

    APP
    Four-Faith
    1.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
CWE
Referencje

Powiązane podatności

CVE-2025-10708MEDIUM5.5ten sam produkt

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affec...

CVE-2025-10709MEDIUM5.5ten sam produkt

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this is...

CVE-2024-9643CRITICAL9.8PL ✓ten sam vendor

Auth Bypass przez zakodowane dane logowania w routerze Four-Faith F3x36

CVE-2024-9644CRITICAL9.8PL ✓ten sam vendor

Auth Bypass w routerze Four-Faith F3x36 – pominięcie uwierzytelnienia

CVE-2024-12856HIGH7.2ten sam vendor

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulner...

CVE-2025-11018 — MEDIUM 5.5 | CVEbaza.pl