Vulnerabilities

TI-2025-13903 CVE-2025-15226 · GHSA-m9qv-jv94-ch3q

Sunnet｜WMPro - Arbitrary File Upload

MEDIUM 49

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00592 Published 2025-12-29 No fix listed CWE-434

TI-2025-13902 CVE-2025-15225 · GHSA-qvjf-wrj2-9pj8

Sunnet｜WMPro - Arbitrary File Read

MEDIUM 44

WMPro developed by Sunnet has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to read arbitrary system files.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00536 Published 2025-12-29 No fix listed CWE-23

TI-2023-17926 CVE-2023-35851 · GHSA-mqp2-c8p6-vr7h

SUNNET WMPro - SQL Injection

MEDIUM 40

SUNNET WMPro portal's FAQ function has insufficient validation for user input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00798 Published 2023-09-18 No fix listed CWE-89

TI-2023-17925 CVE-2023-35850 · GHSA-j7g3-cwpc-q3vh

SUNNET WMPro - Command Injection

LOW 35

SUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00928 Published 2023-09-18 No fix listed CWE-78

TI-2019-08271 CVE-2019-11062 · GHSA-jchh-3cmp-9fh5

SUNNET WMPro v5.0 and v5.1 has OS Command Injection

MEDIUM 51

The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php".

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05703 Published 2019-07-11 No fix listed CWE-78