What’s Vulnerable › Vulnerabilities

CVE-2020-37008: EasyPMS 1.0.0 - Authentication Bypass

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-29 · updated 2026-06-17
• Weakness: CWE-639

Description

EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.

Affected products

• Elektraweb EasyPMS: 1.0.0

References

• https://www.elektraweb.com/en/
• https://www.exploit-db.com/exploits/48858
• https://www.vulncheck.com/advisories/easypms-authentication-bypass
• https://www.exploit-db.com/exploits/48858

Get alerted when CVE-2020-37008 or the next vulnerability affects your stack