CVE-2025-11630

RainyGao DocSys (versions up to 2.02.36) is affected by a path traversal in the File Upload component. The vulnerability is in the function updateRealDoc within /Doc/uploadDoc.do, triggered by manipulating the path parameter. It is remotely exploitable and the exploit is public. Several sources c...

CVE-2025-11631

Affected software : RainyGao DocSys up to 2.02.36. Vulnerability : path traversal in the file /Doc/deleteDoc.do via manipulation of the path parameter. Impact : potential for unauthorized file system access; described as remote, with prior public exploit. Multiple connected sources corroborate th...

CVE-2025-11629

RainyGao DocSys up to version 2.02.36 contains a SQL injection in the getUserList function (/Manage/getUserList.do). The vulnerability allows remote exploitation; exploit information has been disclosed publicly. Multiple sources (Red Hat, EU ENISA, CVE records, and PT Security) consistently ident...