PT-2026-35994 · Undefined · Undefined

Publicado 2026-04-29 · Atualizado 2026-04-29 · CVE-2018-25311

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download xml.pl, download.pl, downloadmib.pl, or downloadFile.pl with directory traversal payloads to read sensitive system files like /etc/passwd.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-25311

Produtos afetados

Undefined

Referências · 4

• https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php · Nota
• https://exploit-db.com/exploits/44386 · Nota
• https://vulncheck.com/advisories/videoflow-digital-video-protection-dvp-10-authenticated-directory-traversal-x-prototype-version · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25311 · Nota de Segurança