CVE-2026-24665

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-24665

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24665.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-24665

Aliases

GHSA-2qgm-m7fm-m888

Published

2026-02-03T16:58:28.914Z

Modified

2026-02-12T01:13:50.196098Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload

Details

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious JavaScript into uploaded assignment files, which is executed when instructors view the submission. This issue has been patched in version 4.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24665.json"
}

References

Affected packages

Git / github.com/gunet/openeclass

Affected ranges

Type: GIT
Repo: https://github.com/gunet/openeclass
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

6a98ba9fb5ce499b53d2cd0708f3080d92632dfa

Affected versions

Release_3.*

Release_3.0

Release_3.1

Release_3.1.1

Release_3.1.2

Release_3.2

Release_4.*

Release_4.0

Release_4.0.1

Release_4.0.2

Release_4.1

Release_4.1.1

Release_4.1.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24665.json"