Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Arox Component: School Erp Pro Clear all filters
TI-2020-19225 CVE-2020-37090 · GHSA-ggf7-6xmv-285q

School ERP Pro 1.0 - Remote Code Execution

Priority HIGH 79

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00918 Published 2026-02-03 No fix listed CWE-434
TI-2020-19224 CVE-2020-37089 · GHSA-85r5-hmf5-6gvm

School ERP Pro 1.0 - 'es_messagesid' SQL Injection

Priority HIGH 70

School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00397 Published 2026-02-03 No fix listed CWE-89
TI-2020-19223 CVE-2020-37088 · GHSA-h3gp-whxh-7hq8

School ERP Pro 1.0 - Arbitrary File Read

Priority HIGH 77

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.02843 Published 2026-02-03 No fix listed CWE-22
TI-2022-13862 CVE-2022-32119 · GHSA-7g4q-55r7-jcwx

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload…

Priority MEDIUM 42

Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the import staff excel function at 1finance_master.inc.php.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01971 Published 2022-07-15 No fix listed CWE-434