CVE-2020-37113 — GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass
GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a w…
Published: 2026-02-03 · CVSS: 8.7 · CVSS 4.0
GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7