What’s Vulnerable › Vulnerabilities

CVE-2020-37112: GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-89

Description

GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the agenda module and other endpoints to extract sensitive database information using error-based or time-based injection techniques.

Affected products

• gunet openeclass: 1.7.3

References

• https://download.openeclass.org/files/docs/1.7/CHANGES.txt
• https://www.exploit-db.com/exploits/48163
• https://www.openeclass.org/
• https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-month-sql-injection

Get alerted when CVE-2020-37112 or the next vulnerability affects your stack