Openeclass

Records13All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

Openeclass records in CISA KEV

No Openeclass vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Openeclass 8 records HIGH

Records

13 records

TI-2024-25765 CVE-2024-38530

Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

HIGH 82

The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00776 Published 2024-08-12 No fix listed CWE-434

TI-2024-20927 CVE-2024-31777 · GHSA-2jw4-8qc2-wm33

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute…

HIGH 76

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03821 Published 2024-06-13 No fix listed CWE-434

TI-2024-17447 CVE-2024-26503 · GHSA-gj96-4654-x98q

Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15…

HIGH 74

Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02961 Published 2024-03-14 No fix listed CWE-434

TI-2020-19251 CVE-2020-37116 · GHSA-8xc9-646q-jmv2

GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access

HIGH 73

GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00493 Published 2026-02-03 No fix listed CWE-284

TI-2020-19248 CVE-2020-37113 · GHSA-fx56-pxgc-fpm7

GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass

HIGH 73

GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00928 Published 2026-02-03 No fix listed CWE-434

TI-2026-17851 CVE-2026-22241

Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

HIGH 67

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.03262 Published 2026-01-08 Fixed in 4.2 CWE-434

TI-2020-19250 CVE-2020-37115 · GHSA-9hrm-54hp-fcpj

GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storage

MEDIUM 64

GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.003 Published 2026-02-03 No fix listed CWE-256

TI-2020-19247 CVE-2020-37112 · GHSA-cvgp-p3c4-h952

GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection

MEDIUM 64

GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00325 Published 2026-02-03 No fix listed CWE-89

TI-2025-40431 CVE-2025-65734 · GHSA-cxx6-4q6w-wp3r

An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments…

MEDIUM 58

An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to execute arbitrary code via uploading a crafted SVG file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00257 Published 2026-03-16 No fix listed CWE-79

TI-2022-14570 CVE-2022-33116 · GHSA-m456-26w4-fmr9

An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass…

LOW 32

An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitrary files via a directory traversal.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01766 Published 2022-06-27 No fix listed CWE-22

TI-2024-21985 CVE-2024-33253 · GHSA-g2cx-52qh-37rp

Cross-site scripting (XSS) vulnerability in GUnet OpenEclass E-learning Platform version…

LOW 29

Cross-site scripting (XSS) vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the ba…

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00411 Published 2024-06-13 No fix listed CWE-79

TI-2017-05043 CVE-2017-7389 · GHSA-xxqw-w7gr-7fqf

Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'.

LOW 29

Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00838 Published 2017-04-01 No fix listed CWE-79

TI-2020-19249 CVE-2020-37114 · GHSA-w5qr-64rw-ppch

GUnet OpenEclass 1.7.3 E-learning platform - Information Disclosure

LOW 24

GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access c…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00388 Published 2026-02-03 No fix listed CWE-200

Open these records in search →

Critical	3
High	5
Medium	5
Low	0
No CVSS	0