Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2020-37090 School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP… https://www.cve.org/CVERecord?id=CVE-2020-37090
Post summary
A file upload vulnerability in School ERP Pro 1.0 permits uploading arbitrary PHP files to the messaging system, potentially enabling remote code execution.
[CVE-2020-37090: CRITICAL] "Beware: School ERP Pro 1.0 vulnerable to file upload flaws. Attacker's PHP scripts pose risks via message attachments, enabling remote code execution on server. #cybersecurity"#cve,CVE-2020-37090,#cybersecurity https://cvefind.com/CVE-2020-37090
Post summary
The message announces a critical vulnerability in School ERP Pro 1.0, noting file upload flaws that allow remote code execution via message attachments, but does not provide a PoC or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | arox | school_erp_pro | 1.0 | - | - |