Skip to main content

Data Leakage Prevention System CVE-2025-11318

MEDIUM
Improper Access Control (CWE-284)
2025-10-06 cna@vuldb.com
Authentication Bypass File Upload Data Leakage Prevention System Tipray
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 19:04 vuln.today
CVE Published
Oct 06, 2025 - 04:15 cve.org
MEDIUM 5.5

DescriptionCVE.org

A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This vulnerability affects unknown code of the file uploadWxFile.do. The manipulation of the argument File results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unrestricted file upload in Tipray Data Leakage Prevention System 1.0 allows unauthenticated remote attackers to upload arbitrary files via the uploadWxFile.do endpoint. A publicly available exploit exists, but the EPSS score of 0.06% and low CVSS impact ratings suggest limited real-world exploitation probability. No vendor patch is available.

More in Data Leakage Prevention System

View all
CVE-2025-11317 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter of t
CVE-2025-11316 MEDIUM POC
5.5 Oct 06

We need to produce a JSON object with all required fields based on the CVE-2025-11316 data. The data includes CVSS 4.0 v
CVE-2025-11314 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray DLP version 1.0 allows remote attackers to manipulate database queries through the 'sort' parame
CVE-2025-11313 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter in f
CVE-2025-11312 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray Data Leakage Prevention System allows remote unauthenticated attackers to inject malicious SQL v
CVE-2025-11311 MEDIUM POC
5.5 Oct 06

We are tasked with generating a comprehensive JSON analysis for CVE-2025-11311. I need to synthesize the provided data:

CVE-2025-11310 MEDIUM POC
5.5 Oct 06

SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote unauthenticated attackers to extract or manipul
CVE-2025-11315 MEDIUM POC
5.5 Oct 06

We need to produce a JSON object with the specified fields. Let's analyze the input. CVE ID: CVE-2025-11315 Description
CVE-2025-11309 MEDIUM POC
5.5 Oct 05

SQL injection in Tipray Data Leakage Prevention System 1.0 via the sort parameter in findDeptPage.do allows remote unaut

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2025-11318 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy