CVE-2025-10709: falha de média gravidade em Four-Faith Water Conservancy Informatization…
Four-Faith Water Conservancy Informatization Platform historyDownload.do;otheruserLogin.do;getfile path traversal
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 1.0%
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
Four-Faith · Water Conservancy Informatization PlatformCVEs relacionadas — Four-Faith Water Conservancy Informatization…
No mesmo produto, das mais perigosas para as menos.
CVE-2025-11018MEDIUMFour-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversalEPSS 1.0%CVE-2025-10708MEDIUMFour-Faith Water Conservancy Informatization Platform historyDownload.do;usrlogout.do path traversalEPSS 1.0%CVE-2025-11337MEDIUMFour-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversalEPSS 0.7%CVE-2025-11336MEDIUMFour-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversalEPSS 0.7%