CVE-2019-25256

VideoFlow Digital Video Protection DVP 2.10 Authenticated Directory Traversal

High7.1EPSS 0.65%

Published: 24 Dec 2025
Updated: 28 Jul 2026
Reserved: 24 Dec 2025
Assigned by: VulnCheck

Description

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files through unvalidated 'ID' parameters. Attackers can exploit multiple Perl scripts like downloadsys.pl to read sensitive files by manipulating directory path traversal in download requests.

Scores

CVSS scores of CVE-2019-25256, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred	4.0	High7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.65% · top 49% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs

Affected products

VideoFlow Ltd. · Digital Video Protection DVP
- affected 2.10
- affected 1.40.0.15
- affected 2.10.0.5

References (3)

ExploitDB-44386 (opens in a new tab)exploit
VideoFlow Product Web Page (opens in a new tab)productexploit
Zero Science Lab Disclosure (ZSL-2018-5454) (opens in a new tab)third-party-advisoryexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-25256](https://trackcve.app/badge/CVE-2019-25256.svg)](https://trackcve.app/cve/CVE-2019-25256)

Record last updated 28 Jul 2026, 01:46 UTC.