Vulnerability · Published Feb 3, 2026 · Assigned by VulnCheck
CVE-2020-37082webERP 4.15.1 - Unauthenticated Backup File Access
Critical 9.8
In plain English
A critical-severity security flaw in webERP from Weberp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 50.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.
Affected products (as reported)
Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-48420 exploit
- Official webERP Vendor Homepage product
- webERP SourceForge Project Page product
- VulnCheck Advisory: webERP 4.15.1 - Unauthenticated Backup File Access third-party-advisory