MEDIUM🇵🇱 Wersja polska

CVE-2025-10708

CVSS 5.5v4.0pub. 2025-09-19upd. 2025-10-03

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /history/historyDownload.do;usrlogout.do. The manipulation of the argument fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Four Faith Water Conservancy Informatization

    APP
    Four-Faith
    1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2025-11018MEDIUM5.5ten sam produkt

A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown fu...

CVE-2025-10709MEDIUM5.5ten sam produkt

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this is...

CVE-2024-9643CRITICAL9.8PL ✓ten sam vendor

Auth Bypass przez zakodowane dane logowania w routerze Four-Faith F3x36

CVE-2024-9644CRITICAL9.8PL ✓ten sam vendor

Auth Bypass w routerze Four-Faith F3x36 – pominięcie uwierzytelnienia

CVE-2024-12856HIGH7.2ten sam vendor

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulner...