CVE-2026-24671: Gunet Open Eclass Platform

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated high-privileged users (teachers or administrators) to inject malicious JavaScript into multiple user-controllable input fields across the application, which is executed when other users access affected pages. This issue has been patched in version 4.2.

Affected products

• Gunet Open Eclass Platform: before 4.2 (fixed in 4.2)

Published 2026-02-03. Last modified 2026-06-17.