Is there a public PoC exploit available for CVE-2025-11310?

Yes, a public proof-of-concept exploit is available for CVE-2025-11310. Prioritise patching immediately. EPSS: 0.0%.

Tipray DLP CVE-2025-11310

Q: What is the CVSS score of CVE-2025-11310?

CVE-2025-11310 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-06 cna@vuldb.com

SQLi Data Leakage Prevention System Tipray

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Remote unauthenticated, low impact based on CVSS 4.0 vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:05 vuln.today

CVE Published

Oct 06, 2025 - 00:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The affected element is the function findFileServerPage of the file findFileServerPage.do. Executing manipulation of the argument sort can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote unauthenticated attackers to extract or manipulate database content via the findFileServerPage.do endpoint. A publicly available exploit exists, but no vendor patch is available. EPSS score is low (0.03%), indicating limited current exploitation activity, though public availability may increase risk.

Technical ContextAI

The vulnerability resides in the findFileServerPage.do endpoint, likely a Java-based Struts-style action handler. The 'sort' parameter is passed unsanitized to a SQL query, enabling classic SQL injection (CWE-74). The affected product is the Tipray Data Leakage Prevention System, version 1.0, as identified by CPE cpe:2.3:a:tipray:data_leakage_prevention_system:1.0:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch identified at time of analysis. As a workaround, restrict network access to the findFileServerPage.do endpoint using firewall rules or web application firewall (WAF) rules that block SQL injection patterns in the 'sort' parameter. If feasible, disable the endpoint entirely. Side effects: blocking the endpoint may impact functionality of the data leakage prevention system's search features. Organizations should monitor for future vendor updates or consider replacing the system if no patch becomes available.