Arox School Erp Pro
6 CVEs affecting Arox School Erp Pro. Latest disclosed: 2026-02-03. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37090 | Critical | 9.8 | 2026-02-03 | School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malici… |
CVE-2022-32119 | High | 8.8 | 2022-07-15 | Arox School ERP Pro v1.0 was discovered to contain multiple arbitrary file upload vulnerabilities via the Add Photo function at photogalleries.inc.php and the… |
CVE-2020-37089 | High | 8.2 | 2026-02-03 | School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET req… |
CVE-2020-37088 | High | 7.5 | 2026-02-03 | School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parame… |
CVE-2020-37084 | High | 7.2 | 2026-02-03 | School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as profile photos by bypa… |
CVE-2022-32118 | Medium | 6.1 | 2022-07-15 | Arox School ERP Pro v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the dispatchcategory parameter in backoffice.inc.php. |