What’s Vulnerable › Vulnerabilities

CVE-2018-25311: VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-29 · updated 2026-06-17
• Weakness: CWE-22

Description

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, or downloadFile.pl with directory traversal payloads to read sensitive system files like /etc/passwd.

Affected products

• VideoFlow Ltd. VideoFlow Digital Video Protection: 2.10, 1.40.0.15, 2.10.0.5

References

• https://www.exploit-db.com/exploits/44386
• https://www.vulncheck.com/advisories/videoflow-digital-video-protection-dvp-10-authenticated-directory-traversal-x-prototype-version
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php

Get alerted when CVE-2018-25311 or the next vulnerability affects your stack