CVE-2020-37084: Arox School ERP Pro

High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days.

School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitrary PHP files as profile photos by bypassing file extension checks. Attackers can exploit improper file validation in pre-editstudent.inc.php to execute arbitrary code on the server.

Affected products

• Arox School ERP Pro: version 1.0 only

Published 2026-02-03. Last modified 2026-06-17.