CVE-2025-15068

HighCVSS 7.7

Published: 29/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

The Web Fax plugin by Gmission has a Missing Authorization vulnerability that allows Authentication Abuse and Session Credential Falsification through Manipulation. This issue affects versions from 3.0 before 3.0.1.

Risk Assessment

An attacker can manipulate sessions or authentication, potentially leading to unauthorized access to plugin functionality.

Recommendation

Update the Web Fax plugin to version 3.0.1 or later, which includes the fix.

Other vulnerabilities in Web Fax

CVE-2025-15070Medium
The Web Fax plugin in versions from 3.0 before 3.0.1 contains an exposure of sensitive information to an unauthorized actor and missing authorization vulnerability. This allows authentication abuse.

Original NVD description (English source)

Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse, Session Credential Falsification through Manipulation.This issue affects Web Fax: from 3.0 before 3.0.1

Vulnerability data from NVD (NIST) · CISA KEV · EPSS