CVE-2025-15225

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.

high 7.5 CVSS 3.1

Published: Dec 29, 2025

Modified: Dec 31, 2025

Vendor: Sun.Net

Product: Wmpro

Description

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.

References

https://www.twcert.org.tw/en/cp-139-10603-67149-2.html
https://www.twcert.org.tw/tw/cp-132-10602-c1c69-1.html

Related CVEs

CVSS Breakdown

Version	3.1
Score	7.5 / 10
Severity	high

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness (CWE)

CWE-23

Affected Product

Vendor	Sun.Net
Product	Wmpro