What’s Vulnerable › Vulnerabilities

CVE-2019-13294

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-04 · updated 2026-06-17
• Weakness: CWE-287

Description

AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. Therefore an unauthenticated user can execute a command on the system.

Affected products

• Arox School-Erp: all versions

References

• http://www.pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html
• https://www.exploit-db.com/exploits/46999
• http://www.pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html
• https://www.exploit-db.com/exploits/46999

Get alerted when CVE-2019-13294 or the next vulnerability affects your stack