VULNERABILITY INTELLIGENCE

CVE-2020-37090

CVSS score9.8 CRITICAL

EPSS probability0.92%

CISA KEVNot currently listed

Published2026-02-03

Last modified2026-06-17

Description

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server.