CVE-2018-20420

PoC —

CVSS 3.0

4.9 medium

EPSS

<1%p60

Published

Dec 24, 2018 (Dec 24, 2018)

Modified

Jun 17, 2026

Description

In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.

Vendors: weberp
Products: weberp
Weakness: CWE-732
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.