GUnet Open eClass Platform any version

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload

Open eClass Insecure Password Reset Token Reuse Enables Account Takeover

GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default.

Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields

Open eClass Broken Access Control Allows Students to Add Content to Course Units

Open eClass Has Broken Access Control in Course Units Module Allows Students to Create Units

Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions

GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.

Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User Fields

Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpoints

Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies

Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction

Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access

Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities