A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A5.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.328041 | Permissions Required VDB Entry |
| https://vuldb.com/?id.328041 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.664843 | Third Party Advisory VDB Entry |
| https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A5.md | Exploit Third Party Advisory |
Configurations
History
31 Oct 2025, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A5.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.328041 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.328041 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.664843 - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:a:docsys_project:docsys:*:*:*:*:*:*:*:* | |
| First Time |
Docsys Project
Docsys Project docsys |
15 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/xkalami-Tta0/CVE/blob/main/DocSys/sql%E6%B3%A8%E5%85%A5.md - |
12 Oct 2025, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-12 07:15
Updated : 2025-10-31 17:25
NVD link : CVE-2025-11629
Mitre link : CVE-2025-11629
CVE.ORG link : CVE-2025-11629
JSON object : View
Products Affected
docsys_project
- docsys