CVE-2020-37088

HIGH 7.5

School ERP Pro 1.0 - Arbitrary File Read

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system credentials and configuration information.

CWE	CWE-22
Vendor	arox
Product	school erp pro
Published	Feb 3, 2026
Last Updated	Mar 5, 2026

Stay Ahead of the Next One

Get instant alerts for arox school erp pro

Be the first to know when new high vulnerabilities affecting arox school erp pro are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Arox / School ERP Pro

1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/48394 web.archive.org: https://web.archive.org/web/20200129123503/http://arox.in/ web.archive.org: https://web.archive.org/web/20190612111732/https://sourceforge.net/projects/school-erp-ultimate/ vulncheck.com: https://www.vulncheck.com/advisories/school-erp-pro-arbitrary-file-read

Credits

Besim ALTINOK