← Vulnerability feed

Vulnerability record · CVE-2020-37082 · published 3 February 2026

CVE-2020-37082: Weberp vulnerability

Weberp · Weberp

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.

8.6 CVSS 4.0 High EPSS 0.57% · top 54.8% CWE-552 · CWE-552
8.6CVSS 4.0 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.weberp.org Product
https://sourceforge.net/projects/web-erp/ Product
https://www.exploit-db.com/exploits/48420 Exploit
https://www.vulncheck.com/advisories/weberp-unauthenticated-backup-file-access Third Party Advisory

Track CVE-2020-37082 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-46052Weberp sql injection vulnerabilityAn error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by i…EPSS 0.50%9.8CVE-2019-13292Weberp sql injection vulnerabilityA SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. T…EPSS 9.3%8.8CVE-2019-7755Weberp sql injection vulnerabilityIn webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement files, resulting in the executio…EPSS 2.1%7.2CVE-2018-19434Weberp sql injection vulnerabilityAn issue was discovered on the "Bank Account Matching - Receipts" screen of the General Ledger component in webERP 4.15. BankMatching.php has Blind S…EPSS 1.1%7.2CVE-2018-19435Weberp sql injection vulnerabilityAn issue was discovered in the Sales component in webERP 4.15. SalesInquiry.php has SQL Injection via the SortBy parameter.EPSS 1.1%7.2CVE-2018-19436Weberp sql injection vulnerabilityAn issue was discovered in the Manufacturing component in webERP 4.15. CollectiveWorkOrderCost.php has Blind SQL Injection via the SearchParts parame…EPSS 1.1%6.5CVE-2020-22474Weberp inclusion from untrusted sphere vulnerabilityIn webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion.EPSS 1.0%5.1CVE-2025-46053Weberp sql injection vulnerabilityA SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted …EPSS 0.24%

Source: NIST National Vulnerability Database (record CVE-2020-37082), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.