Vulnerabilities

TI-2026-19891 CVE-2026-24669

Open eClass Insecure Password Reset Token Reuse Enables Account Takeover

LOW 35

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00183 Published 2026-02-03 Fixed in 4.2 CWE-613

TI-2026-19890 CVE-2026-24668

Open eClass Broken Access Control Allows Students to Add Content to Course Units

LOW 28

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00245 Published 2026-02-03 Fixed in 4.2 CWE-284

TI-2026-19889 CVE-2026-24667

Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access

LOW 22

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00153 Published 2026-02-03 Fixed in 4.2 CWE-613

TI-2026-19888 CVE-2026-24666

Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions

LOW 28

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00185 Published 2026-02-03 Fixed in 4.2 CWE-352

TI-2026-19887 CVE-2026-24665

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload

LOW 39

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00222 Published 2026-02-03 Fixed in 4.2 CWE-79

TI-2026-19975 CVE-2026-24774

Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities

LOW 20

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00238 Published 2026-02-03 Fixed in 4.2 CWE-841

TI-2026-19974 CVE-2026-24773

Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files

LOW 39

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00418 Published 2026-02-03 Fixed in 4.2 CWE-639

TI-2026-19896 CVE-2026-24674

Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpoints

LOW 27

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0022 Published 2026-02-03 Fixed in 4.2 CWE-79

TI-2026-19895 CVE-2026-24673

Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction

LOW 24

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00286 Published 2026-02-03 Fixed in 4.2 CWE-434

TI-2026-19894 CVE-2026-24672

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields

LOW 33

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00222 Published 2026-02-03 Fixed in 4.2 CWE-79

TI-2026-19893 CVE-2026-24671

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User Fields

LOW 29

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00222 Published 2026-02-03 Fixed in 4.2 CWE-79

TI-2026-19892 CVE-2026-24670

Open eClass Has Broken Access Control in Course Units Module Allows Students to Create Units

LOW 28

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00245 Published 2026-02-03 Fixed in 4.2 CWE-284

TI-2026-19886 CVE-2026-24664

Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies

LOW 30

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00297 Published 2026-02-03 Fixed in 4.2 CWE-204

TI-2020-19251 CVE-2020-37116 · GHSA-8xc9-646q-jmv2

GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access

HIGH 73

GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00493 Published 2026-02-03 No fix listed CWE-284

TI-2020-19250 CVE-2020-37115 · GHSA-9hrm-54hp-fcpj

GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storage

MEDIUM 64

GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.003 Published 2026-02-03 No fix listed CWE-256

TI-2020-19249 CVE-2020-37114 · GHSA-w5qr-64rw-ppch

GUnet OpenEclass 1.7.3 E-learning platform - Information Disclosure

LOW 24

GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access c…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00388 Published 2026-02-03 No fix listed CWE-200

TI-2020-19248 CVE-2020-37113 · GHSA-fx56-pxgc-fpm7

GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension Bypass

HIGH 73

GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00928 Published 2026-02-03 No fix listed CWE-434

TI-2020-19247 CVE-2020-37112 · GHSA-cvgp-p3c4-h952

GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection

MEDIUM 64

GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00325 Published 2026-02-03 No fix listed CWE-89

TI-2026-17851 CVE-2026-22241

Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

HIGH 67

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.

CVSS 4.0HIGH 7.3 Network High privileges No interaction EPSS 0.03262 Published 2026-01-08 Fixed in 4.2 CWE-434

TI-2024-25765 CVE-2024-38530

Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"

HIGH 82

The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00776 Published 2024-08-12 No fix listed CWE-434

TI-2021-19938 CVE-2021-44266 · GHSA-6m7g-w73h-3h6r

GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.

LOW 29

GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01045 Published 2022-06-11 No fix listed CWE-79

TI-2020-14923 CVE-2020-24381 · GHSA-5jjh-v59v-w68q

GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to…

LOW 36

GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data director…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01356 Published 2020-08-19 No fix listed CWE-200

Vulnerabilities

Filters