Vulnerabilidades do Gunet Openeclass

CVE-2026-24774 Média · 4.3 CWE-841 03/02/2026

Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a business logic vulnerability allows authenticated students to improperly mark themselves as present in attendance activities, including activities that have already expired, by directly accessing a crafted URL. This issue has been patched in version 4.2.

CVE-2026-24773 Alta · 7.5 CWE-639 03/02/2026

Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows unauthenticated remote attackers to access personal files of other users by directly requesting predictable user identifiers. This issue has been patched in version 4.2.

CVE-2026-24674 Média · 6.1 CWE-79 03/02/2026

Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpoints

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Reflected Cross-Site Scripting (XSS) vulnerability allows remote attackers to execute arbitrary JavaScript in the context of authenticated users by crafting malicious URLs and tricking victims into visiting them. This issue has been patched in version 4.2.

CVE-2026-24673 Média · 5.3 CWE-434 03/02/2026

Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnerability allows attackers to upload files with prohibited extensions by embedding them inside ZIP archives and extracting them using the application’s built-in decompression functionality. This issue has been patched in version 4.2.

CVE-2026-24672 Média · 5.4 CWE-79 03/02/2026

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when users with viewing privileges access affected application pages. This issue has been patched in version 4.2.

CVE-2026-24671 Média · 4.8 CWE-79 03/02/2026

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User Fields

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated high-privileged users (teachers or administrators) to inject malicious JavaScript into multiple user-controllable input fields across the application, which is executed when other users access affected pages. This issue has been patched in version 4.2.

CVE-2026-24670 Média · 6.5 CWE-284 03/02/2026

Open eClass Has Broken Access Control in Course Units Module Allows Students to Create Units

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability allows authenticated students to create new course units, an action normally restricted to higher-privileged roles. This issue has been patched in version 4.2.

CVE-2026-24669 Alta · 7.8 CWE-613 03/02/2026

Open eClass Insecure Password Reset Token Reuse Enables Account Takeover

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password reset mechanism allows local attackers to reuse a valid password reset token after it has already been used, enabling unauthorized password changes and potential account takeover. This issue has been patched in version 4.2.

CVE-2026-24668 Média · 6.5 CWE-284 03/02/2026

Open eClass Broken Access Control Allows Students to Add Content to Course Units

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability allows authenticated students to add content to existing course units, an action normally restricted to higher-privileged roles. This issue has been patched in version 4.2.

CVE-2026-24667 Média · 5.0 CWE-613 03/02/2026

Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2.

CVE-2026-24666 Média · 6.5 CWE-352 03/02/2026

Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows attackers to induce authenticated teachers to perform unintended actions, such as modifying assignment grades, via crafted requests. This issue has been patched in version 4.2.

CVE-2026-24665 Média · 5.4 CWE-79 03/02/2026

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious JavaScript into uploaded assignment files, which is executed when instructors view the submission. This issue has been patched in version 4.2.

CVE-2026-24664 Média · 5.3 CWE-204 03/02/2026

Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability allows unauthenticated attackers to identify valid user accounts by analyzing differences in the login response behavior. This issue has been patched in version 4.2.

CVE-2026-22241 Alta · 7.2 Exploit público CWE-434 08/01/2026

Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.