CVE-2020-37113

GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature.

• CWE-434

• https://download.openeclass.org/files/docs/1.7/CHANGES.txtRelease Notes
• https://www.exploit-db.com/exploits/48163Exploit, Third Party Advisory, VDB Entry
• https://www.openeclass.org/Product
• https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-file-upload-extension-bypassThird Party Advisory

Published

Feb 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-37108PhpIX 2012 Professional contains a SQL injection vulnerabili…7.1
• CVE-2020-37109aSc TimeTables 2020.11.4 contains a denial of service vulner…7.5
• CVE-2020-3711Adobe Illustrator CC versions 24.0 and earlier have a memory…7.8
• CVE-2020-3711060CycleCMS 2.5.2 contains an SQL injection vulnerability in …9.8
• CVE-2020-3711160CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulne…6.1
• CVE-2020-37112GUnet OpenEclass 1.7.3 contains multiple SQL injection vulne…6.5
• CVE-2020-37114GUnet OpenEclass 1.7.3 allows unauthenticated and authentica…6.5
• CVE-2020-37115GUnet OpenEclass 1.7.3 stores user credentials in plaintext,…4.9
• CVE-2020-37116GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by defau…8.8
• CVE-2020-37117jizhiCMS 1.6.7 contains a file download vulnerability in the…8.8
• CVE-2020-37118P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request…5.1
• CVE-2020-37119Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vuln…9.8