Vulnerability · Published Jan 29, 2026 · Assigned by VulnCheck
CVE-2020-37008EasyPMS 1.0.0 - Authentication Bypass
High 7.5
In plain English
A high-severity authorization bypass via user-controlled key in EasyPMS from Elektraweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elektraweb | EasyPMS | 1.0.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-48858 exploit
- Vendor Homepage product
- VulnCheck Advisory: EasyPMS 1.0.0 - Authentication Bypass third-party-advisory