CVE-2020-37113: Gunet Open Eclass Platform

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature.

Affected products

• Gunet Open Eclass Platform: version 1.7.3 only

Published 2026-02-03. Last modified 2026-06-17.