CVE-2025-11629
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
A remote attacker could exploit the SQL Injection vulnerability to read, modify, or delete database data, potentially compromising confidentiality, integrity, and availability. The lack of a vendor patch increases the risk.
Recommendation
Restrict access to the /Manage/getUserList.do endpoint and consider deploying WAF rules to filter SQL Injection attempts. Monitor vendor communications and plan migration to an alternative solution if no fix is released.
Other vulnerabilities in DocSys
See all- CVE-2026-67678Critical
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code.
- CVE-2026-75328High
In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability.
- CVE-2026-75413High
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.
Original NVD description (English source)
A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS