CVE-2020-37082

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-552

Description

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.

References

http://www.weberp.org
https://sourceforge.net/projects/web-erp/
https://www.exploit-db.com/exploits/48420
https://www.vulncheck.com/advisories/weberp-unauthenticated-backup-file-access

Status: profiled · ingested 2026-10-07T12:00:43.000Z