Home

Description

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files through unvalidated 'ID' parameters. Attackers can exploit multiple Perl scripts like downloadsys.pl to read sensitive files by manipulating directory path traversal in download requests.

PUBLISHED Reserved 2025-12-24 | Published 2025-12-24 | Updated 2025-12-24 | Assigner VulnCheck




HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

2.10
affected

1.40.0.15
affected

2.10.0.5
affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.video-flow.com exploit

www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php exploit

www.exploit-db.com/exploits/44386 (ExploitDB-44386) exploit

www.video-flow.com (VideoFlow Product Web Page) product

www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5454.php (Zero Science Lab Disclosure (ZSL-2018-5454)) third-party-advisory

cve.org (CVE-2019-25256)

nvd.nist.gov (CVE-2019-25256)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.