CVE-2025-11018: medium-severity vulnerability in Four-Faith Water Conservancy Informatization…
Four-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversal
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 1.0%
A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Four-Faith · Water Conservancy Informatization PlatformRelated CVEs — Four-Faith Water Conservancy Informatization…
In the same product, most dangerous first.
CVE-2025-10709MEDIUMFour-Faith Water Conservancy Informatization Platform historyDownload.do;otheruserLogin.do;getfile path traversalEPSS 1.0%CVE-2025-10708MEDIUMFour-Faith Water Conservancy Informatization Platform historyDownload.do;usrlogout.do path traversalEPSS 1.0%CVE-2025-11337MEDIUMFour-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversalEPSS 0.7%CVE-2025-11336MEDIUMFour-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversalEPSS 0.7%