CVE-2019-15129: Humanica Humatrix 7

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_name] URI.

Affected products

• Humanica Humatrix 7: version 1.0.0.203 only; version 1.0.0.681 only

Published 2019-08-18. Last modified 2026-06-17.