CVE-2018-25311
VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS 7.1EPSS 0.6%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado
Lifecycle
29 Apr 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, or downloadFile.pl with directory traversal payloads to read sensitive system files like /etc/passwd.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
VideoFlow Ltd. · VideoFlow Digital Video Protectionpublic PoCs found — 1
cve_referencewww.exploit-db.com/exploits/44386unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.