GCVE - cpe:2.3:a:gunet:open_eclass_platform:1.7.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gunet:open_eclass_platform:1.7.3:*:*:*:*:*:*:*

part: a version: 1.7.3 update: *

Vendor	Gunet (`92dc1390-b545-53d9-878b-b76b16033bbf`)
Product	Open Eclass Platform (`6d2fd5de-c667-5d77-ad50-d87ca63aa0e0`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/gunet/openeclass`	purl2cpe	2026-06-01 10:16:13.720732

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-37116`	vulnerable	2026-06-08 05:25:50.187039	GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access HIGH (8.8) GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise. Published: 2026-02-03T16:52:47.396Z Updated: 2026-07-28T01:47:12.054Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48163 https://www.openeclass.org/ https://download.openeclass.org/files/docs/1.7/CHANGES.txt https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-phpmyadmin-remote-access	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-37115`	vulnerable	2026-06-08 05:25:50.186723	GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storage MEDIUM (6.5) GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and increases the risk of credential theft and unauthorized access. Published: 2026-02-03T16:52:46.843Z Updated: 2026-07-28T01:47:11.338Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48163 https://www.openeclass.org/ https://download.openeclass.org/files/docs/1.7/CHANGES.txt https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-plaintext-password-storage	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-37114`	vulnerable	2026-06-08 05:25:50.186365	GUnet OpenEclass 1.7.3 E-learning platform - Information Disclosure MEDIUM (4.3) GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. Attackers can retrieve system info, version info, and view or download other users' files without proper authorization. Published: 2026-02-03T16:52:46.277Z Updated: 2026-07-28T01:47:10.643Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48163 https://www.openeclass.org/ https://download.openeclass.org/files/docs/1.7/CHANGES.txt https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-information-disclosure	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-37113`	vulnerable	2026-06-08 05:25:50.185878	GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass HIGH (8.8) GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature. Published: 2026-02-03T16:52:45.772Z Updated: 2026-07-28T01:47:09.959Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48163 https://www.openeclass.org/ https://download.openeclass.org/files/docs/1.7/CHANGES.txt https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-file-upload-extension-bypass	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-37112`	vulnerable	2026-06-08 05:25:50.185320	GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection HIGH (7.1) GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the agenda module and other endpoints to extract sensitive database information using error-based or time-based injection techniques. Published: 2026-02-03T16:52:45.252Z Updated: 2026-03-05T01:28:05.055Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48163 https://www.openeclass.org/ https://download.openeclass.org/files/docs/1.7/CHANGES.txt https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-month-sql-injection	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.