CVE-2020-37082
CRITICAL
2026-02-03
[email protected]
9.8
CVSS 3.1
Share
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Lifecycle Timeline
3
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Feb 11, 2026 - 18:51 vuln.today
Public exploit code
CVE Published
Feb 03, 2026 - 22:16 nvd
CRITICAL 9.8
Description
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.
Analysis
webERP 4.15.1 has an unauthenticated file access vulnerability allowing remote attackers to download sensitive files including configuration and database credentials.
Technical Context
webERP 4.15.1 has a CWE-552 file access vulnerability that allows unauthenticated users to access files that should be restricted, including configuration files containing database credentials.
Affected Products
['webERP 4.15.1']
Remediation
Update webERP. Restrict file access at the web server level.
Priority Score
69
Low
Medium
High
Critical
KEV: 0
EPSS: +0.3
CVSS: +49
POC: +20
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).