MEDIUM🇵🇱 Wersja polska

CVE-2025-10709

CVSS 5.5v4.0pub. 2025-09-19upd. 2025-10-03

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Four Faith Water Conservancy Informatization

    APP
    Four-Faith
    1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2025-11018MEDIUM5.5ten sam produkt

A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown fu...

CVE-2025-10708MEDIUM5.5ten sam produkt

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affec...

CVE-2024-9643CRITICAL9.8PL ✓ten sam vendor

Auth Bypass przez zakodowane dane logowania w routerze Four-Faith F3x36

CVE-2024-9644CRITICAL9.8PL ✓ten sam vendor

Auth Bypass w routerze Four-Faith F3x36 – pominięcie uwierzytelnienia

CVE-2024-12856HIGH7.2ten sam vendor

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulner...