Is there a public PoC exploit available for CVE-2025-11313?

Yes, a public proof-of-concept exploit is available for CVE-2025-11313. Prioritise patching immediately. EPSS: 0.0%.

Tipray DLP CVE-2025-11313

Q: What is the CVSS score of CVE-2025-11313?

CVE-2025-11313 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-06 cna@vuldb.com

SQLi Data Leakage Prevention System Tipray

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Remote, low complexity, no privileges or interaction; SQLi typically yields low confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:05 vuln.today

CVE Published

Oct 06, 2025 - 02:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A flaw has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This impacts the function findRolePage of the file findRolePage.do. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter in findRolePage.do, potentially leading to unauthorized database read or modification. Public exploit code is available, but no actively exploited incidents are reported and the exploitation probability (EPSS 0.03%) is very low. The vendor has not responded to the disclosure and no patch is confirmed.

Technical ContextAI

The vulnerability resides in the web-accessible endpoint findRolePage.do of the Tipray DLP application (CPE: cpe:2.3:a:tipray:data_leakage_prevention_system:1.0). The underlying issue is an SQL injection (CWE-74) caused by improper sanitization of the sort argument passed to the findRolePage function. Attackers can inject arbitrary SQL through this parameter, leveraging the application's database connection to interact with the backend data store without proper input validation.

RemediationAI

No vendor-released patch exists at this time. As an interim measure, restrict network access to the findRolePage.do endpoint to trusted IPs only, deploy a web application firewall rule to block SQLi patterns on the sort parameter, and audit database logs for anomalous queries. Disabling the findRolePage functionality is a stronger control but may disrupt legitimate DLP operations. Monitor VulDB and vendor communications for an eventual patch.