MEDIUM🇵🇱 Wersja polska

CVE-2025-11018

CVSS 5.5v4.0pub. 2025-09-26upd. 2025-10-08

A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Four Faith Water Conservancy Informatization

    APP
    Four-Faith
    1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2025-10708MEDIUM5.5ten sam produkt

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affec...

CVE-2025-10709MEDIUM5.5ten sam produkt

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this is...

CVE-2024-9643CRITICAL9.8PL ✓ten sam vendor

Auth Bypass przez zakodowane dane logowania w routerze Four-Faith F3x36

CVE-2024-9644CRITICAL9.8PL ✓ten sam vendor

Auth Bypass w routerze Four-Faith F3x36 – pominięcie uwierzytelnienia

CVE-2024-12856HIGH7.2ten sam vendor

The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulner...