VULNERABILITY INTELLIGENCE
CVE-2018-25311
CVSS score7.1 HIGH
EPSS probability0.60%
CISA KEVNot currently listed
Published2026-04-29
Last modified2026-06-17
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, or downloadFile.pl with directory traversal payloads to read sensitive system files like /etc/passwd.
Weakness classification
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')