Unrestricted file upload in Tipray Data Leakage Prevention System 1.0 allows unauthenticated remote attackers to upload arbitrary files via the uploadWxFile.do endpoint. A publicly available exploit exists, but the EPSS score of 0.06% and low CVSS impact ratings suggest limited real-world exploitation probability. No vendor patch is available.
We need to produce a JSON object with specific fields. Let's analyze the input carefully. Input: - CVE ID: CVE-2025-11341 - Description: "A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited." - CVSS Score: 5.5 (looks like a score, but vector is CVSS v4.0. I'll use that.) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-610 Externally Controlled Reference to a Resource in Another Sphere (probably XML External Entity) - EPSS Score: 0.03% (percentile 10%) - POC/Exploit: Publicly available - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* (version up to 2.0) - Tags: XXE, Jinher Oa - References: three VulDB links, one GitHub issue. Potential for KEV? No mention of KEV in input, so not in KEV. So exploitation status: "publicly available exploit code exists" because POC/Exploit says publicly available, but no KEV confirmation. So "publicly available exploit code exists". We'll note that. Now fields: product_name: "Jinher OA" (up to 2.0). Product name is "Jinher OA". So "Jinher OA" (1-3 words). I'll just use "Jinher OA". summary: 2-3 sentence plain-language synthesis. Do not copy description. Start with impact verb and product. E.g. "XML External Entity (XXE) injection in Jinher OA up to version 2.0 allows unauthenticated remote attackers to read local files or perform server-side request forgery via crafted XML input to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx". The description says "xml external entity reference", remote exploitation possible. Exploit publicly released. EPSS low. No KEV. So summary: "An XML External Entity (XXE) injection vulnerability in Jinher OA (up to version 2.0) allows unauthenticated attackers to exfiltrate local files or perform SSRF by sending crafted requests to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx. Exploit code is publicly available, but EPSS suggests low exploitation probability." Actually EPSS 0.03% is very low, but exploit publicly available. So mention POC available. Start with "XML External Entity (XXE) injection in Jinher OA allows unauthenticated remote attackers to...". Yes. technical_context: Mention the underlying technology: Jinher OA is an office automation platform likely using ASP.NET (from the .aspx path). The vulnerability is CWE-610, XXE. The attack vector is remote, via HTTP request to a specific page. The CPE is cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*, indicating all versions up to 2.0. The vulnerability arises from parsing untrusted XML with external entity processing enabled. The file path suggests a WebDesign.aspx page that processes XML. Use educational tone. risk_assessment: Use provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N with impacts VC:L/VI:L/VA:L (confidentiality, integrity, availability all low). EPSS 0.03%, very low exploitation probability. No KEV. POC publicly available. CVSS score 5.5 (medium). So risk: low threat activity but easy attack, so moderate risk if exposed. Check conflicting signals: CVSS indicates network vector, unauthenticated, low impact. EPSS suggests rare active exploitation. So while exploit is available, it's not widely targeted. So risk is limited to specific exposed instances. No conflicting. affected_products: Write paragraph: "Jinher OA versions up to 2.0, as identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The specific vulnerable endpoint is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx?type=SystemUserInfo&style=1. Vendor advisory may be available from VulDB (links provided)." But we need to avoid bullet points, just narrative. So: "Jinher OA versions up to and including 2.0 are affected. The known vulnerable file is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx with specific parameters. The vendor advisory is tracked by VulDB (https://vuldb.com/?id.327226)." remediation: No patch version given. No mention of fixed version. So we need to suggest compensating controls. Since no patch, recommend: "Upgrade to a version beyond 2.0 if available, or apply input validation to disable XML external entity processing. As an immediate mitigation, restrict network access to the vulnerable endpoint or implement a web application firewall (WAF) rule to block XXE payloads. Disabling DTD processing in the XML parser configuration, if possible, would prevent exploitation." No exact version, so say: "No vendor-released patch has been confirmed; mitigate by disabling XML external entity processing or restricting access to the vulnerable aspx page." We'll craft. exploit_scenario: Realistic attack: An attacker sends a specially crafted HTTP request to the vulnerable endpoint containing a malicious XML payload with an external entity that points to a local file (e.g., /etc/passwd) or an external server to exfiltrate data. Since no authentication is required (PR:N), remote unauthenticated exploitation is possible. POC available. exploitation_conditions: The CVSS vector shows AV:N, so network accessible. PR:N so no authentication needed? Vector says PR:N, so unauthenticated. UI:N, so no user interaction. No specific conditions in description beyond the endpoint URL. It says "Performing manipulation results in xml external entity reference." No mention of special configuration. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Jinher OA up to 2.0, provided the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint is accessible over the network." The file path is specific, so it must be accessible. No limiting factors like authentication, so it's wide open. So: "No authentication or user interaction is required; the vulnerable endpoint must be reachable over the network. The attack works with default configurations." That's enough. attack_chain: Follow kill chain: Remote attacker discovers vulnerable endpoint → Sends crafted XML request with external entity → XML parser processes entity, allowing file read or SSRF → Impact (Confidentiality/Integrity/Availability low). We'll use: "Send crafted HTTP POST request to vulnerable endpoint → XML parser resolves external entity → Exfiltrate sensitive file contents or perform SSRF". Steps: Access → Delivery (HTTP request with XML) → Exploit (XXE) → Execution (entity resolution) → Impact (file read/SSRF). I'll construct a chain of 4 steps: "Send crafted XML payload to WebDesign.aspx → Trigger XML external entity processing → Access arbitrary local files via entity resolution → Use exfiltrated data or trigger SSRF for further access". That's 4. Good. confidence_notes: We know exploit code is publicly available (GitHub issue referenced). The CVSS vector provided is from VulDB likely, but NVD hasn't published yet? The CVE is from VulDB. NVD references include the GitHub link as exploit. No vendor confirmation, just VulDB report. So: "Exploit code confirmed publicly available via GitHub. Affected product and version range confirmed by CPE from VulDB. No official vendor advisory or patch identified; patch status unknown. CVSS vector from VulDB indicates network-accessible, unauthenticated attack with low impact." We'll state what's missing. prevalence: Jinher OA is an office automation platform, likely Chinese product. How widely deployed? I'm not sure. It might be niche. I'll estimate low or medium? I'm leaning low because it's not a globally known product. Possibly used in some Chinese enterprises. I'll go with "low" and basis: "niche Chinese OA platform, limited enterprise deployment". Might be unknown but I'll pick low. prevalence_basis: "niche Chinese OA platform, limited global footprint." That's within 12 words. assessed_cvss_vector: We're supposed to provide our own CVSS 3.1 vector, not copy the given 4.0 one. Given the description: remote, unauthenticated, XXE. Attack vector: Network (AV:N). Attack Complexity: Low (AC:L) because just sending crafted request. Privileges Required: None (PR:N) because no authentication mentioned. User Interaction: None (UI:N) because no user involved. Scope: Unchanged? XXE can sometimes lead to scope change if exfiltrating data from a different system, but typically file read is on the same system, so Scope U. Confidentiality Impact: Low (C:L) as described in VC:L. Integrity Impact: Low (I:L). Availability Impact: Low (A:L). So vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's consistent. I'll output that as my assessed CVSS 3.1 vector. assessed_cvss_rationale: "Remote network exploitation without authentication or user interaction, with low confidentiality, integrity, and availability impacts from file read and SSRF." assessed_cvss40_vector: They already gave one, but I'll produce my own assessment consistent with the 3.1 vector. For 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. I'll use that. Now assemble JSON. Ensure all fields are strings. No arrays, no nesting. Use double quotes. Make sure the summary does not say "A vulnerability..." but start with "XML External Entity (XXE) injection in Jinher OA...". Yes. technical_context: mention CWE-610 and that it's an XML parsing issue with external entity processing. Use CPE to point to affected product. "The vulnerability is an XML External Entity injection (CWE-610) in the Jinher OA web application, which likely uses an ASP.NET XML parser that defaults to enabling external entity resolution. The vulnerable endpoint processes user-supplied XML in a POST request, and by crafting a malicious XML document with an external entity pointing to a local file or internal resource, an attacker can read sensitive files or initiate SSRF. The CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* captures all versions up to 2.0." risk_assessment: "CVSS 4.0 scores this as 5.5 Medium, with network attack vector, low complexity, no privileges or user interaction required, and low impact on all three CIA metrics. The EPSS estimate of 0.03% suggests very low likelihood of active exploitation in the wild, despite the public availability of exploit code. No CISA KEV entry indicates no known active exploitation campaigns. Overall, this is a straightforward XXE vulnerability but with limited post-exploitation impact, making it a moderate priority for organizations using the affected product." affected_products: "Jinher OA versions up to and including 2.0, identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The vulnerability is located in the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint with specific parameters. The report is available at VulDB (https://vuldb.com/?id.327226)." remediation: "Apply the vendor patch if available (no specific version identified in the advisory). As a workaround, disable XML external entity processing in the application's XML parser configuration, or restrict network access to the vulnerable .aspx file using a WAF or firewall rules. Disabling DTD resolution entirely may break legitimate functionality if required by the application; test thoroughly before deploying." exploit_scenario: "An unauthenticated remote attacker sends a specially crafted HTTP POST request to the vulnerable /c6/Jhsoft.Web
SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter of the findSingConfigPage.do endpoint, potentially leading to unauthorized database access. Public exploit code is available but no active exploitation has been confirmed (not in CISA KEV), and the EPSS score is a low 0.03%, indicating limited immediate risk. The vendor has not responded to disclosure and no patch is available.
We need to produce a JSON object with all required fields based on the CVE-2025-11316 data. The data includes CVSS 4.0 vector, but we need to produce an assessed CVSS 3.1 vector and rationale, and an assessed CVSS 4.0 vector consistent with our assessment. Also, we need to synthesize from the description, EPSS, POC/exploit, tags, CPE, CWE, references. There is no KEV mention, so KEV is not active. The exploit has been publicly disclosed, so POC/Exploit is publicly available. We'll note that. The vendor didn't respond. No patch info available. So remediation should mention no vendor patch, suggest compensating controls if possible (but we need specific conditions). The description: "A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of the file findCategoryPage.do. Executing manipulation of the argument tenantId can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized." So SQL injection in tenantId parameter. Remote. No auth mentioned. The CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... So the base metrics imply network vector, low attack complexity, no attack requirements, no privileges, no user interaction, low impact on vulnerable system, no scope change. So the base score would be: CVSS 4.0 base formula: use AV:N (0.2), AC:L (0.1), AT:N (0.1) -> Attack Vector weight: 0.2 * 0.1 * 0.1? Actually need to compute properly, but we'll produce a vector consistent with the input, but we are to give our own independent assessment. Since we have little else, we might adopt the same vector as the provided CVSS 4.0 for vulnerable system metrics (VC/VI/VA=L), and SC/SI/SA=N. So our assessed CVSS 4.0 vector could be: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. The E:P is from the exploit maturity, not base. So we'll output base onl
SQL injection in Tipray DLP version 1.0 allows remote attackers to manipulate database queries through the 'sort' parameter in the findSingConfigPage.do endpoint. The vulnerability has a publicly available exploit, but EPSS indicates very low exploitation probability and no active exploitation confirmed by CISA KEV. Successful exploitation may lead to low-impact loss of confidentiality, integrity, or availability.
SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter in findRolePage.do, potentially leading to unauthorized database read or modification. Public exploit code is available, but no actively exploited incidents are reported and the exploitation probability (EPSS 0.03%) is very low. The vendor has not responded to the disclosure and no patch is confirmed.
SQL injection in Tipray Data Leakage Prevention System allows remote unauthenticated attackers to inject malicious SQL via the sort parameter in findModulePage.do, compromising database confidentiality and integrity. Exploit code is publicly available, but the EPSS probability is very low (0.03%), indicating limited exploitation likelihood due to the product's niche footprint.
We are tasked with generating a comprehensive JSON analysis for CVE-2025-11311. I need to synthesize the provided data: CVE description, CVSS 4.0 vector, CWE-74, EPSS (0.03%, low), POC/exploit publicly available (from tags), CPE for Tipray Data Leakage Prevention System 1.0, references, and no KEV mentioned. I must produce JSON with specified fields. First, I'll extract key info: - Product: Tipray Data Leakage Prevention System (DLP) version 1.0, by 厦门天锐科技股份有限公司. - Vulnerability: SQL injection in function findTenantPage of file findTenantPage.do, argument sort leads to SQLi. Remote attack possible. - CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - though typically SQLi is CWE-89, but it's labeled CWE-74, which is broader injection. I'll mention root cause as SQL injection, but CWE-74 might be a misclassification. I can note that it's an injection vulnerability leading to SQL command execution. - CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So network attack, low complexity, no privileges, no user interaction, vulnerable component likely the database with low impacts on confidentiality, integrity, availability. No subsequent impact. Exploit code maturity: Proof-of-concept (E:P). So it's an unauthenticated SQLi with low impact. - EPSS: 0.03% (very low exploitation probability), 9th percentile. So unlikely to be widely exploited, but POC exists. - No KEV: Not in CISA Known Exploited Vulnerabilities catalog. So no evidence of active exploitation. - Exploit availability: "The exploit has been disclosed publicly and may be used." So POC public. "Tags: SQLi, Data Leakage Prevention System" confirms. - CPE: cpe:2.3:a:tipray:data_leakage_prevention_system:1.0 indicates the specific product version. - References: includes a GitHub link to a vuln report, vuldb.com entries. The vendor did not respond. Now, I'll craft each field. product_name: "Data Leakage Prevention System" (3 word
SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote unauthenticated attackers to extract or manipulate database content via the findFileServerPage.do endpoint. A publicly available exploit exists, but no vendor patch is available. EPSS score is low (0.03%), indicating limited current exploitation activity, though public availability may increase risk.
SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to inject SQL via the 'editid' parameter in /visitor-detail.php, potentially exfiltrating or modifying database information. Public exploit code is available, but EPSS score of 0.03% indicates low likelihood of exploitation.
We need to produce a JSON analysis. The input provides CVE details, description, CVSS score (5.5) but that appears to be a CVSS v4.0 vector with base score likely computed from it? The given vector shows AV:N/AC:L/AT:N/PR:N/UI:N... so base score might be 5.5 but let's compute: CVSS 4.0 base metrics: AV:N/AC:L/AT:N/PR:N/UI:N impact to vulnerable system: VC:L/VI:L/VA:L (low on all), subsequent system: SC:N/SI:N/SA:N. The base score formula for CVSS 4.0: from spec, with SC:N/SI:N/SA:N, it's impact to VC,VI,VA only. The base score = max(impact score, exploitability score). Impact sub-score (ISS) = 1 - [(1-VC)*(1-VI)*(1-VA)] = 1 - (0.78*0.78*0.78)=1-0.474552=0.525448? wait VC=L=0.22? Actually CVSS 4.0 uses the same values as CVSS 3.1 for impact subscore? The CVSS 4.0 base score calculation: Exploitability (ESS) = something. But the base score as given is 5.5, which can be derived from that vector. So I'll accept that as the assessed score by NVD? The vector provided is a CVSS 4.0 vector, not 3.1. We need to produce our own assessed CVSS 3.1 and 4.0 vectors. I'll assess independently. Description: SQL injection in code-projects Online Course Registration 1.0, file /admin/manage-students.php, parameter ID. Remote. Public exploit exists. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), but SQL injection is CWE-89 typically. CWE-74 is generic, but could be mapping. EPSS 0.03%, low. POC available. Not in KEV. Unknown patch status from input. We need to produce all fields. Product name: "Online Course Registration Site" (from CPE product) or "Online Course Registration"? The description says "code-projects Online Course Registration 1.0". CPE: fabian:online_course_registration_site:1.0. The vendor is "code-projects"? Actually "code-projects" is the website domain. The CPE product is "online_course_registration_site". So product name: "Online Course Registration Site 1.0" (maybe just "Online Course Registration Sit
SQL injection in code-projects Student Crud Operation 3.3 via the `ID` parameter of `delete.php` allows remote unauthenticated attackers to perform mass deletion of records, impacting data integrity and service availability. Public exploit code is available, but the vulnerability carries very low exploitation probability (EPSS 0.03%) and is not listed in CISA KEV. This is a niche application with minimal real-world footprint.
We need to produce a JSON object with the specified fields. Let's analyze the input. CVE ID: CVE-2025-11315 Description: vulnerability in Tipray Data Leakage Prevention System (天锐数据泄露防护系统) version 1.0. The function findUserPage in findUserPage.do has SQL injection via sort argument. Remote exploitation possible. Exploit made public. Vendor contacted but did not respond. CVSS Score: 5.5 (is that CVSS v4.0? The vector provided is CVSS:4.0, so the score is likely the CVSS v4.0 score 5.5. But the input says "CVSS Score: 5.5" and then "CVSS Vector: CVSS:4.0/..." which is consistent. So it's a medium score. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), but SQL injection is CWE-89. The CWE given is CWE-74, which is a parent of injection. Actually CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" and SQL injection is a child. But the description explicitly says SQL injection. So we'll mention that. EPSS: 0.03% (low), percentile 7%. POC/Exploit: Publicly available Keys: KEV not mentioned, so NOT in KEV. So exploitation: "publicly available exploit code exists" (but not confirmed actively exploited). No mention of KEV in data. So no active exploitation confirmed. Tags: SQLi, Data Leakage Prevention System References: there are NVD links to vuldb and a github POC. CPE: cpe:2.3:a:tipray:data_leakage_prevention_system:1.0:*:*:*:*:*:*:* Now we need to fill each field. product_name: "Tipray Data Leakage Prevention System" is too long? Need 1-3 words. Options: "Tipray DLP", "Tipray Data Leakage Prevention System" is 4 words. "Tipray DLP" might be best, but that's an abbreviation. The product full name is "Data Leakage Prevention System" by Tipray. I'd go with "Tipray DLP" as it's short and recognizable. But the description says "Tipray Data Leakage Prevention System" and "天锐数据泄露防护系统". I'll use "Tipray DLP" as shorthand. Or "Tipray Data Leakage Prevention System" but that's 4 words. Might be "Tipray DLP System"? No. I'll use "Tipray DLP". I think it's fine, "DLP" is common. But the instruction says "1-3 words ONLY." So I'll do "Tipray DLP". Yes. summary: Start with impact verb and product. "SQL injection in Tipray DLP 1.0 allows remote attackers to manipulate database queries via the sort parameter of findUserPage.do." Then add extra: "Exploit code is publicly available, and the vendor has not responded to disclosure. EPSS score is 0.03%, indicating low exploitation likelihood, but the vulnerability is easy to exploit." So original synthesis, not copying description. I'll craft a concise 2-3 sentences. technical_context: Explain: the vulnerability is in findUserPage.do endpoint, likely a web-based user management page that uses unsanitized sort parameter for sorting user results, leading to SQL injection (CWE-89, subset of CWE-74). The product is a Data Leakage Prevention System, typically deployed in enterprise environments to monitor/block data exfiltration. The affected product is version 1.0, as per CPE. CWE-74 indicates injection in output, but SQL injection suggests improper neutralization of input before SQL query. So I'll explain. risk_assessment: CVSS v4.0 base score 5.5 (medium), vector with AV:N/AC:L/AT:N/PR:N/UI:N, so network attack, low complexity, no privileges, no user interaction. Impact to vulnerable system: L/L/L (confidentiality, integrity, availability all low). No impact to subsequent system. EPSS 0.03% (very low exploitation probability). No KEV. POC public. So risk: low-medium. SSVC: exploitation: public PoC, no active exploitation; automatable: likely automatable (UN:N), technical impact: limited (low impact on each). So decision may be "track" or "remediate" depending on context. Compare signals: CVSS medium, EPSS very low, public PoC, vendor unresponsive, so no patch. So it's a low-risk vulnerability but could be easily exploited if exposed. But exposure of DLP system may be internal, so network vector might be internal network only. So risk is limited. I'll state: "CVSSv4.0 scores 5.5 (Medium), indicating limited impact. EPSS of 0.03% suggests exploitation is unlikely, but public exploit code exists. No active exploitation reported. The attack requires network access to the DLP web interface, which is likely internal-only, reducing external risk." affected_products: CPE specifies Tipray Data Leakage Prevention System:1.0. So: "Tipray Data Leakage Prevention System version 1.0 is affected. The vendor has not released a patch or advisory. No CPE for other versions, but 1.0 is explicitly affected." Add references to vuldb etc. remediation: No vendor patch. So suggest: "No vendor-released patch identified. As a temporary workaround, restrict network access to the DLP management interface to trusted administrators only. Validate and sanitize sort parameter input using parameterized queries if source code is accessible. Consider deploying a web application firewall rule to block SQL injection attempts against findUserPage.do." Mention side effects: restricting access may limit legitimate remote administration. Note that patch version is unknown. So remediation paragraph. exploit_scenario: "An attacker sends a specially crafted HTTP request to the findUserPage.do endpoint with a malicious sort parameter containing SQL payload. This allows extraction of database contents or manipulation of data, potentially bypassing data protection policies." Given public PoC. exploitation_conditions: Need to extract exact prerequisites. The vulnerability is in the findUserPage function accessed via the web endpoint, and requires the sort parameter to be manipulated. No authentication mentioned? The CVSS vector says PR:N (no privileges required). So remote unauthenticated exploitation, but the DLP interface might not be exposed to the public internet, often internal. The condition: "Access to the findUserPage.do endpoint of the Tipray DLP web interface (version 1.0). No authentication mentioned; the vector suggests unauthenticated access. The attack does not require user interaction." So I'll state: "No special conditions — remote unauthenticated exploitation against the default configuration of Tipray DLP 1.0. The sort parameter of findUserPage.do is directly reachable. No authentication required, as per CVSS vector." Might add that the web interface may be internal, but that's a deployment condition, not a product condition. attack_chain: I'll craft a chain: Recon (identify DLP endpoint) → Craft SQL injection payload in sort parameter → Send HTTP request to findUserPage.do → Trigger SQL injection in backend database → Extract data or modify database. Something like: "Discover findUserPage.do endpoint → Inject SQL payload via sort parameter → Database executes malicious query → Exfiltrate sensitive data or compromise database". Keep 3-7 steps. I'll do 4 steps: "Identify DLP web interface → Send crafted HTTP request with SQL payload in sort parameter → Backend executes unsanitized SQL query → Extract or manipulate database contents". That covers access, exploit, impact. confidence_notes: "Public exploit code confirmed via GitHub PoC (reference). Affected version 1.0 confirmed by CPE; no vendor advisory. No patch version known. CVSSv4.0 vector provided, indicating unauthenticated remote access (PR:N). EPSS data available. No KEV listing." prevalence: The product is a Data Leakage Prevention System by a Chinese vendor (Tipray/厦门天锐科技股份有限公司). DLP systems are typically used in enterprises, but not as widespread as general web servers. Tipray is not a globally dominant vendor; likely a niche product in Chinese market. So prevalence: "low" or "medium"? I'd say "low" because it's a specific vendor's DLP product, likely not as widely deployed as something like Symantec DLP or Forcepoint. So "low". Prevalence_basis: "niche vendor's DLP appliance, likely limited enterprise footprint". So "low" and "niche vendor, limited deployment scope". assessed_cvss_vector: My own independent assessment. The description says remote exploitation, SQL injection. Attack vector: Network (AV:N), Attack Complexity: Low (AC:L) because sort parameter is directly injectable. Privileges Required: According to CVSS v4.0 vector, PR:N. Need to decide PR honestly. The description doesn't mention authentication; the GitHub PoC might show no auth. So PR:N seems plausible. User Interaction: None (UI:N). Scope: The CVSS v4.0 vector says S:N (no scope change). In CVSS 3.1, scope is separate, but SQL injection typically doesn't change scope unless accessing other database, but generally it's the same vulnerable component (the web app) so S:U. Confidentiality, Integrity, Availability: SQL injection can allow reading, modifying, deleting data. So impact ratings: C:L I:L A:L? Actually SQL injection often leads to high impact if full database access, but the vector says L/L/L. That's a low impact. I'll go with low impact as the vector indicates limited impact. The description doesn't specify that the injection can read sensitive data or execute commands; it's a generic SQL injection. I'd say C:L, I:L, A:L. So CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. I'll craft vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a base score of 6.5? Actually CVSS 3.1 score for that vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: 6.5 (Medium). But the given CVSSv4.0 score is 5.5, which is lower. I'll stick with the assessed vector based on my judgment, not copy. So S:U, C:L I:L A:L. So vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: "Remote unauthenticated access with low complexity; SQL injection yields partial data disclosure and modification." So assessed_cvss_vector string. assessed_cvss40_vector: Convert to CVSS 4.0. With AV:N AC:L AT:N PR:N UI:N, VC:L VI:L VA:L, SC:N SI:N SA:N. So: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's consistent with the input vector minus subsequent system impact? The provided vector had VC:L VI:L VA:L and SC:N SI:N SA:N. So my assessed CVSS4.0 vector is identical to the one in input, but I'm assessing. So I'll output that. But it says "Your OWN independent ... grounded in the description and exploitation conditions — NOT a copy of any score in the input." The input vector is exactly that: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N ... but with extra temporal/environmental placeholders. I'll just output the base: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's a copy? It's based on the description, so it's okay if it matches, I'm not copying an external score but my assessment yields the same. I'll just state that vector. Rationale for CVSS 3.1: "Requires no privileges or user interaction; SQL injection yields partial data access and modification." Now assemble JSON. I'll be careful with all the rules. The CWE-74 mentioned, but SQL injection is CWE-89. I'll mention in technical_context. Check "prevalence_basis": "niche vendor DLP appliance, limited deployment scope" (12 words max). So "niche vendor, limited enterprise footprint" 4 words okay. assessed_cvss_rationale: for 3.1: "
Cross-site scripting in EndRun Technologies Sonoma D12 GPS Network Time Server firmware 6010-0071-000 Ver 4.00 allows a remote unauthenticated attacker to inject and execute malicious scripts in the context of an authenticated user's browser session against the device's web management interface. Exploitation requires the attacker to trick an administrator into interacting with a crafted URL or page, after which the scope crosses into the victim's browser context, enabling session theft or credential harvesting. No public exploit confirmed at time of analysis, and EPSS of 0.22% (13th percentile) signals low automated exploitation activity.
Authorization bypass in Logo Cloud (all versions before 0.67) allows an authenticated high-privilege user to manipulate user-controlled key parameters to access resources outside their authorization scope via forceful browsing, resulting in high confidentiality impact alongside limited integrity and availability effects. The flaw is a classic Insecure Direct Object Reference (IDOR) pattern (CWE-639) made exploitable over the network without user interaction. No public exploit code exists and the EPSS score sits at 0.05% (17th percentile), indicating very low observed exploitation probability; however, the data-exposure risk for affected deployments warrants prompt patching to version 0.67.
Path traversal in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0076-000 Ver 4.00) exposes sensitive files to authenticated network attackers. The flaw resides in the device's web interface, where insufficiently validated path input allows an attacker to escape the intended directory root and read arbitrary files from the underlying filesystem. No public exploit code or active exploitation has been confirmed at time of analysis, but a third-party security researcher advisory exists at xdiv-sec.github.io detailing the issue.
Open redirect in Logo Cloud before version 2025.R6 enables phishing and forceful browsing attacks against authenticated users who click attacker-crafted URLs. The CVSS vector (PR:L/UI:R) confirms the attacker requires low-privilege access and victim interaction, making this a social-engineering-dependent vulnerability. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating negligible opportunistic exploitation activity at time of analysis.
Stored or persistent cross-site scripting in Logo Cloud versions before 1.18 allows a high-privileged authenticated attacker to inject malicious scripts into web pages served by the application. Successful exploitation can result in limited confidentiality, integrity, and availability impact within the application's scope. No public exploit code exists and EPSS sits at the 14th percentile (0.04%), indicating this is not actively targeted in the wild at time of analysis.
Improper output encoding in Logo Cloud before version 2.57 enables phishing attacks by allowing injected or unescaped content to be rendered in the application context. The CVSS vector (PR:H/UI:R) narrows the realistic threat to authenticated high-privilege users who can introduce malicious output that is then presented to other users without proper sanitization. No active exploitation is confirmed - no CISA KEV listing and an EPSS score of 0.03% (10th percentile) both signal this is low-priority in the broader threat landscape.