https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-37082.htmlhttps://patchthecve.com/cve/CVE-2020-37082.htmlWed, 07 Oct 2026 08:10:00 +0000CRITICAL 9.8: webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Attackers can directly access generated backup files in the companies/weberp/ directory by requesting the Backup_[timestamp].sql.gz file.https://patchthecve.com/cve/CVE-2025-46053.htmlhttps://patchthecve.com/cve/CVE-2025-46053.htmlWed, 17 Jun 2026 09:25:54 +0000MEDIUM 5.1: A SQL Injection vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL commands and extract sensitive data by injecting a crafted payload into the ReportID and ReplaceReportID parameters within a POST request to /reportwriter/admin/ReportCreator.phphttps://patchthecve.com/cve/CVE-2025-46052.htmlhttps://patchthecve.com/cve/CVE-2025-46052.htmlWed, 17 Jun 2026 09:25:53 +0000CRITICAL 9.8: An error-based SQL Injection (SQLi) vulnerability in WebERP v4.15.2 allows attackers to execute arbitrary SQL command and extract sensitive data by injecting a crafted payload into the DEL form field in a POST request to /StockCounts.php