CVE-2020-37082

The record

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.

Affected packages

Related vulnerabilities

• CVE-2026-75164 An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie… CWE-552
• CVE-2026-74853 The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display… CWE-552
• CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI… CWE-552
• CVE-2026-85175 SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the… CWE-552
• CVE-2026-73735 Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated… CWE-552
• CVE-2026-73736 A vulnerability in the web-based management interface of HPE Networking Fabric Composer… CWE-552
• CVE-2026-82020 Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability… CWE-552
• CVE-2026-75889 Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can… CWE-552