CVE-2025-15070

MediumCVSS 5.5

Published: 29/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

23th percentile - higher than 23% of all known CVEs

Summary

The Web Fax plugin in versions from 3.0 before 3.0.1 contains an exposure of sensitive information to an unauthorized actor and missing authorization vulnerability. This allows authentication abuse.

Risk Assessment

An attacker could gain access to sensitive information or bypass authentication mechanisms, potentially leading to unauthorized access to the fax system.

Recommendation

Update the Web Fax plugin to version 3.0.1 or later.

Other vulnerabilities in Web Fax

CVE-2025-15068High
The Web Fax plugin by Gmission has a Missing Authorization vulnerability that allows Authentication Abuse and Session Credential Falsification through Manipulation. This issue affects versions from 3.0 before 3.0.1.

Original NVD description (English source)

Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse. This issue affects Web Fax: from 3.0 before 3.0.1

Vulnerability data from NVD (NIST) · CISA KEV · EPSS