CVE-2023-37287

CVE-2023-37287 is a critical vulnerability affecting SmartBPM.NET, stemming from the use of a hard-coded authentication key. This flaw allows an unauthenticated remote attacker to gain regular user privileges, enabling them to read application data and execute submission and approval processes. With a CVSS score of 9.1 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, posing a high risk to confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.