What is the CVSS score of CVE-2020-37008?

CVE-2020-37008 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of JSON are affected by CVE-2020-37008?

EasyPMS 1.0.0 contains a critical authentication bypass vulnerability (CVE-2020-37008) that allows unauthorized users to extract admin credentials and sensitive data through SQL injection in JSON…

Is there a public PoC exploit available for CVE-2020-37008?

Yes, a public proof-of-concept exploit is available for CVE-2020-37008. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2020-37008?

Within 24 hours: Isolate or disable EasyPMS 1.0.0 instances from production if possible; enable comprehensive logging and audit admin account activity for unauthorized access. Within 7 days: Conduct forensic review of access logs for exploitation attempts; reset all admin passwords; implement network-level restrictions (IP whitelisting, WAF rules blocking suspicious JSON payloads). Within 30 days: Evaluate migration to alternative solutions or vendors with active security support; implement mandatory code review for authentication mechanisms if upgrading to patched versions becomes available.

JSON CVE-2020-37008

HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-01-29 disclosure@vulncheck.com

Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Jan 29, 2026 - 17:16 vuln.today

Public exploit code

CVE Published

Jan 29, 2026 - 15:16 nvd

HIGH 7.5

DescriptionCVE.org

EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.

AnalysisAI

EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-639 (Authorization Bypass Through User-Controlled Key). EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.

Affected ProductsAI

EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admi

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2020-37008 vulnerability details – vuln.today

Back

JSON CVE-2020-37008

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code