VulnerabilityAnalyzed
CVE-2025-10709
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0.
MEDIUM 5.5EPSS 0.97%
Does this matter?
Lower severity and a low EPSS score (0.97%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CVSS 4.0
- 5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.97% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- four-faith/water conservancy informatization
- Source
- cna@vuldb.com
References
- https://github.com/Cstarplus/CVE/issues/5Exploit, Issue Tracking, Third Party Advisory
- https://vuldb.com/?ctiid.324997Permissions Required, VDB Entry
- https://vuldb.com/?id.324997Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.644874Third Party Advisory, VDB Entry
- https://github.com/Cstarplus/CVE/issues/5Exploit, Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.