PT-2026-5832 · Weberp · Weberp

Besim Altinok · Published 2026-02-03 · Updated 2026-02-03 · CVE-2020-37082

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions webERP version 4.15.1

Description An unauthenticated file access issue allows remote attackers to download database backup files. Attackers can directly access generated backup files located in the 'companies/weberp/' directory by requesting the Backup [timestamp].sql.gz file.

Recommendations For version 4.15.1, restrict access to the 'companies/weberp/' directory to prevent unauthorized downloads of backup files.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2020-37082

Affected Products

Weberp

References · 6

• 🔥 https://exploit-db.com/exploits/48420 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37082 · Security Note
• https://osv.dev/vulnerability/CVE-2020-37082 · Vendor Advisory
• http://weberp.org · Note
• https://sourceforge.net/projects/web-erp · Note
• https://vulncheck.com/advisories/weberp-unauthenticated-backup-file-access · Note