Skip to main content

Data Leakage Prevention System CVE-2025-11312

MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2025-10-06 cna@vuldb.com
SQLi Data Leakage Prevention System Tipray
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 19:05 vuln.today
CVE Published
Oct 06, 2025 - 01:15 cve.org
MEDIUM 5.5

DescriptionCVE.org

A vulnerability was detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findModulePage of the file findModulePage.do. The manipulation of the argument sort results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Tipray Data Leakage Prevention System allows remote unauthenticated attackers to inject malicious SQL via the sort parameter in findModulePage.do, compromising database confidentiality and integrity. Exploit code is publicly available, but the EPSS probability is very low (0.03%), indicating limited exploitation likelihood due to the product's niche footprint.

More in Data Leakage Prevention System

View all
CVE-2025-11318 MEDIUM POC
5.5 Oct 06

Unrestricted file upload in Tipray Data Leakage Prevention System 1.0 allows unauthenticated remote attackers to upload

CVE-2025-11317 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter of t
CVE-2025-11316 MEDIUM POC
5.5 Oct 06

We need to produce a JSON object with all required fields based on the CVE-2025-11316 data. The data includes CVSS 4.0 v
CVE-2025-11314 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray DLP version 1.0 allows remote attackers to manipulate database queries through the 'sort' parame
CVE-2025-11313 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter in f
CVE-2025-11311 MEDIUM POC
5.5 Oct 06

We are tasked with generating a comprehensive JSON analysis for CVE-2025-11311. I need to synthesize the provided data:

CVE-2025-11310 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote unauthenticated attackers to extract or manipul
CVE-2025-11315 MEDIUM POC
5.5 Oct 06

We need to produce a JSON object with the specified fields. Let's analyze the input. CVE ID: CVE-2025-11315 Description
CVE-2025-11309 MEDIUM POC
5.5 Oct 05

SQL injection in Tipray Data Leakage Prevention System 1.0 via the sort parameter in findDeptPage.do allows remote unaut

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2025-11312 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy