CVE-2020-37115
GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storage
- State
- Published
- Severity
- 7.1 High
- Published
- Feb 3, 2026
- Updated
- Jul 28, 2026
- Reserved
- Feb 3, 2026
Description
GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and increases the risk of credential theft and unauthorized access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-256 Use of Hard-coded Password or Plaintext Storage of a Password
Affected Products
| Product | Versions |
|---|---|
GUnet OpenEclassOpeneclass |
|
References
- ExploitDB-48163exploit
- Official Vendor Homepageproduct
- Changelogpatch
- VulnCheck Advisory: GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storagethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.