What is CVE-2020-37089?

CVE-2020-37089 is a high-severity vulnerability in Arox School Erp Pro, classified under SQL Injection. CVSS score: 8.2/10. Published 2026-02-03.

How severe is CVE-2020-37089?

High severity. CVSS v3 base score is 8.2 out of 10.

SQL Injection in Arox School Erp Pro

CVE-2020-37089

School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET requests. Attackers can exploit the vulnerable parameter by injecting crafted SQL statements to potentially extract, modify, or delete database information.

Vulnerability class: SQL Injection

EPSS: 0.003 (26.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Arox School Erp Pro — versions 1.0
Arox School_erp_pro — versions 1.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

disclosure@vulncheck.com (Exploit, VDB Entry, Third Party Advisory, exploit)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Broken Link, third-party-advisory)

Frequently asked questions

What is CVE-2020-37089?: CVE-2020-37089 is a high-severity vulnerability in Arox School Erp Pro, classified under SQL Injection. CVSS score: 8.2/10. Published 2026-02-03.
How severe is CVE-2020-37089?: High severity. CVSS v3 base score is 8.2 out of 10.