CVE-2020-37186: Chevere Spa Chevereto

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Chevereto 3.13.4 Core contains a remote code execution vulnerability that allows attackers to inject malicious code during database configuration installation. Attackers can manipulate the database table prefix parameter to write a PHP shell file and execute arbitrary system commands through a crafted POST request.

Affected products

• Chevere Spa Chevereto: up to and including 3.13.4

Published 2026-02-11. Last modified 2026-06-17.