PT-2026-6204 · Unknown · Open Eclass

Stolichnayer · Publicado 2026-02-03 · Atualizado 2026-02-03 · CVE-2026-24672

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2

Description The Open eClass platform, previously known as GUnet eClass, a course management system, contains a Stored Cross-Site Scripting (XSS) issue. Authenticated students can inject malicious JavaScript into user profile fields. This JavaScript is executed when users with viewing privileges access the affected application pages. Stored Cross-Site Scripting (XSS) occurs when malicious scripts are persistently stored on the target servers, such as in databases, message forums, visitor logs, or comment fields.

Recommendations Update to version 4.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-24672

GHSA-3P2X-QGXW-QVXH

Produtos afetados

Open Eclass

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24672.json · Exploit
• https://github.com/gunet/openeclass/security/advisories/GHSA-3p2x-qgxw-qvxh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24672 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-24672 · Aviso do Fabricante
• https://t.me/CVEtracker/43637 · Publicação no Telegram