What is the CVSS score of CVE-2020-37082?

CVE-2020-37082 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Weberp are affected by CVE-2020-37082?

WebERP versions up to 4.15.1 contain a critical vulnerability (CVSS 9.8) that allows unauthorized external access to sensitive files and directories.

Is there a public PoC exploit available for CVE-2020-37082?

Yes, a public proof-of-concept exploit is available for CVE-2020-37082. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2020-37082?

Within 24 hours: Audit all WebERP instances for version 4.15.1 or earlier; immediately isolate affected systems from internet-facing access if patching cannot be completed within 72 hours. Within 7 days: Implement compensating controls listed below; conduct forensic analysis of access logs to identify potential compromise. Within 30 days: Migrate to a patched version or replace WebERP if vendor support has ended; validate data integrity and assess for unauthorized access or exfiltration.

Weberp CVE-2020-37082

CRITICAL

Files or Directories Accessible to External Parties (CWE-552)

2026-02-03 disclosure@vulncheck.com

Path Traversal Information Disclosure Weberp

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 11, 2026 - 18:51 vuln.today

Public exploit code

CVE Published

Feb 03, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.

AnalysisAI

webERP 4.15.1 has an unauthenticated file access vulnerability allowing remote attackers to download sensitive files including configuration and database credentials.

Technical ContextAI

webERP 4.15.1 has a CWE-552 file access vulnerability that allows unauthenticated users to access files that should be restricted, including configuration files containing database credentials.