PT-2026-6204 · Unknown · Open Eclass

Stolichnayer · Published 2026-02-03 · Updated 2026-02-03 · CVE-2026-24672

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Open eClass versions prior to 4.2

Description The Open eClass platform, previously known as GUnet eClass, a course management system, contains a Stored Cross-Site Scripting (XSS) issue. Authenticated students can inject malicious JavaScript into user profile fields. This JavaScript is executed when users with viewing privileges access the affected application pages. Stored Cross-Site Scripting (XSS) occurs when malicious scripts are persistently stored on the target servers, such as in databases, message forums, visitor logs, or comment fields.

Recommendations Update to version 4.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24672

GHSA-3P2X-QGXW-QVXH

Affected Products

Open Eclass

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24672.json · Exploit
• https://github.com/gunet/openeclass/security/advisories/GHSA-3p2x-qgxw-qvxh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24672 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24672 · Vendor Advisory
• https://t.me/CVEtracker/43637 · Telegram Post