CVE-2025-15225

HighCVSS 7.5

Published: 29/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

44th percentile - higher than 44% of all known CVEs

Summary

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.

Risk Assessment

An unauthenticated attacker could read sensitive system files, potentially leading to data leakage and system security compromise.

Recommendation

Apply patches from the vendor and implement proper path filtering mechanisms.

Other vulnerabilities in WMPro

CVE-2025-15226Critical
WMPro developed by Sunnet has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Original NVD description (English source)

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS