OpenOLAT

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

OpenOLAT records in CISA KEV

No OpenOLAT vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Openolat 9 records MEDIUM

Records

9 records

TI-2024-17072 CVE-2024-25974 · GHSA-frwq-jm7h-q2q2

Stored Cross-Site Scripting (XSS) within the Media Center

MEDIUM 58

The Frentix GmbH OpenOlat LMS is affected by stored a Cross-Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0055 Published 2024-02-20 No fix listed CWE-20

TI-2026-24492 CVE-2026-31946

OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow

MEDIUM 48

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0021 Published 2026-03-30 Fixed in 20.2.5 CWE-287

TI-2021-16566 CVE-2021-39180

Path Traversal in Archive Handling Leading to Code Execution

MEDIUM 43

OpenOLAT is a web-based learning management system (LMS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02441 Published 2021-08-31 Fixed in 15.3.18, 15.5.3 CWE-22

TI-2021-16567 CVE-2021-39181

Unsafe Deserialization of User Data Using XStream

MEDIUM 42

OpenOlat is a web-based learning management system (LMS).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01909 Published 2021-09-01 Fixed in 15.3.18, 15.5.3 CWE-91

TI-2026-22563 CVE-2026-28228

OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution

MEDIUM 40

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00421 Published 2026-03-30 Fixed in 19.1.31, 20.1.18 +1 CWE-1336

TI-2021-18077 CVE-2021-41242

Path Traversal in some REST methods leading to file upload to arbitrary places

LOW 38

OpenOlat is a web-basedlearning management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01489 Published 2021-12-10 Fixed in 15.5.12, 16.0.5 CWE-23

TI-2021-17991 CVE-2021-41152

Path Traversal in Folder Component Leading to Local File Inclusion

LOW 36

OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning management system.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.0124 Published 2021-10-18 Fixed in 15.5.8 CWE-22

TI-2024-18774 CVE-2024-28198

XML external entity (XXE) injection in OpenOLAT

LOW 33

OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00431 Published 2024-03-11 Fixed in 18.1.6 CWE-611

TI-2024-17071 CVE-2024-25973 · GHSA-2q9p-5gw5-gr76

Multiple Stored Cross-Site Scripting Vulnerabilities

LOW 25

The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00561 Published 2024-02-20 No fix listed CWE-20

Open these records in search →

Critical	1
High	6
Medium	2
Low	0
No CVSS	0