Read the docs

Arox

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Arox records in CISA KEV

No Arox vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
School Erp Pro 6 records HIGH School Erp Pro+responsive 3 records MEDIUM School Management Software Php/mysql 2 records LOW School-erp 1 record MEDIUM School Erp Php Script 1 record MEDIUM

Records

13 records

TI-2020-19225 CVE-2020-37090 · GHSA-ggf7-6xmv-285q

School ERP Pro 1.0 - Remote Code Execution

Priority HIGH 79

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00918 Published 2026-02-03 No fix listed CWE-434
TI-2020-19223 CVE-2020-37088 · GHSA-h3gp-whxh-7hq8

School ERP Pro 1.0 - Arbitrary File Read

Priority HIGH 77

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.02843 Published 2026-02-03 No fix listed CWE-22
TI-2020-19224 CVE-2020-37089 · GHSA-85r5-hmf5-6gvm

School ERP Pro 1.0 - 'es_messagesid' SQL Injection

Priority HIGH 70

School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00397 Published 2026-02-03 No fix listed CWE-89
TI-2024-04496 CVE-2024-4824 · GHSA-q2r8-99fj-x7qv

SQL Injection in School ERP Pro+Responsive by AROX SOLUTION

Priority MEDIUM 50

Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00737 Published 2024-05-13 No fix listed CWE-89
TI-2022-13862 CVE-2022-32119 · GHSA-7g4q-55r7-jcwx

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload…

Priority MEDIUM 42

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01971 Published 2022-07-15 No fix listed CWE-434
TI-2024-04495 CVE-2024-4823 · GHSA-wr68-32ff-7373

Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION

Priority LOW 29

Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1 and dc2.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00471 Published 2024-05-13 No fix listed CWE-79
Open these records in search →