CVE-2025-11629CWE-74CWE-89sql-injection

CVE-2025-11629

Medium · published October 12, 2025

CVSS v3.1

6.3

EPSS

Percentile

34.4

In the wild

Unconfirmed

What it is

A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00413 · 34.4th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-10-12T11:15Z

Affected products (1)

Product	Versions	Fixed in
docsys_project/docsys	≤ 2.02.36	—

References (5)

https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A5.md · [email protected]https://vuldb.com/?ctiid.328041 · [email protected]https://vuldb.com/?id.328041 · [email protected]https://vuldb.com/?submit.664843 · [email protected]https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A5.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

12 OCT 07:02Z
RainyGao DocSys getUserList.do getUserList sql injection
cvelistv5