CVE-2025-15066

MediumCVSS 6.2/10Last modified Oct 7, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This issue affects Innorix WP from All versions If the "exam" directory exists under the directory where the product is installed (ex: innorix/exam)

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Dec 29, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-150677.7Unrestricted Upload of File with Dangerous Type vulnerability in Innorix Innorix WP allows Upload a Web Shell to a Web Server.This issue aff CVE-2025-150689.8Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse, Session Credential Falsification through Manipulation.T CVE-2025-150699.8Improper Authentication vulnerability in Gmission Web Fax allows Privilege Escalation.This issue affects Web Fax: from 3.0 before 3.0.1 CVE-2025-15075.3The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi CVE-2025-150706.5Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Ab CVE-2025-150739.8A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us CVE-2025-150749.8A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file CVE-2025-150759.8A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /s CVE-2025-150767.3A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lea CVE-2025-150779.8A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the CVE-2025-150789.8A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_re CVE-2025-150795.3When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting