EasyPMS 1.0.0 - Authentication Bypass | Advisories

Advisories

EasyPMS 1.0.0 - Authentication Bypass

severity: none
date: January 29, 2026
Affecting: EasyPMS 1.0.0
CVE: CVE-2020-37008
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 0
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-48858
Vendor Homepage
Credit: Jok3r
Description: EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.