Is there a public PoC exploit available for CVE-2025-11311?

Yes, a public proof-of-concept exploit is available for CVE-2025-11311. Prioritise patching immediately. EPSS: 0.0%.

Data Leakage Prevention System CVE-2025-11311

Q: What is the CVSS score of CVE-2025-11311?

CVE-2025-11311 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-06 cna@vuldb.com

SQLi Data Leakage Prevention System Tipray

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:05 vuln.today

CVE Published

Oct 06, 2025 - 00:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The impacted element is the function findTenantPage of the file findTenantPage.do. The manipulation of the argument sort leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

We are tasked with generating a comprehensive JSON analysis for CVE-2025-11311. I need to synthesize the provided data: CVE description, CVSS 4.0 vector, CWE-74, EPSS (0.03%, low), POC/exploit publicly available (from tags), CPE for Tipray Data Leakage Prevention System 1.0, references, and no KEV mentioned. I must produce JSON with specified fields.

First, I'll extract key info:

Product: Tipray Data Leakage Prevention System (DLP) version 1.0, by 厦门天锐科技股份有限公司.
Vulnerability: SQL injection in function findTenantPage of file findTenantPage.do, argument sort leads to SQLi. Remote attack possible.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - though typically SQLi is CWE-89, but it's labeled CWE-74, which is broader injection. I'll mention root cause as SQL injection, but CWE-74 might be a misclassification. I can note that it's an injection vulnerability leading to SQL command execution.
CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So network attack, low complexity, no privileges, no user interaction, vulnerable component likely the database with low impacts on confidentiality, integrity, availability. No subsequent impact. Exploit code maturity: Proof-of-concept (E:P). So it's an unauthenticated SQLi with low impact.
EPSS: 0.03% (very low exploitation probability), 9th percentile. So unlikely to be widely exploited, but POC exists.
No KEV: Not in CISA Known Exploited Vulnerabilities catalog. So no evidence of active exploitation.
Exploit availability: "The exploit has been disclosed publicly and may be used." So POC public. "Tags: SQLi, Data Leakage Prevention System" confirms.
CPE: cpe:2.3:a:tipray:data_leakage_prevention_system:1.0 indicates the specific product version.
References: includes a GitHub link to a vuln report, vuldb.com entries. The vendor did not respond.

Now, I'll craft each field.

product_name: "Data Leakage Prevention System" (3 word