Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
27 results
Mar 16, 2026An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to CVE-2025-65734 · Other software · Openeclass · reported by MITREMedium 5.4
An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to execute arbitrary code via uploading a crafted SVG file.
- Product
- Openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24774 · Other software · gunet · reported by GitHubMedium 4.3
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a business logic vulnerability allows authenticated students to improperly mark themselves as present in attendance activities, including activities that have already expired, by directly accessing a crafted URL. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24773 · Other software · gunet · reported by GitHubHigh 7.5
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows unauthenticated remote attackers to access personal files of other users by directly requesting predictable user identifiers. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24674 · Other software · gunet · reported by GitHubMedium 4.7
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Reflected Cross-Site Scripting (XSS) vulnerability allows remote attackers to execute arbitrary JavaScript in the context of authenticated users by crafting malicious URLs and tricking victims into visiting them. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24673 · Other software · gunet · reported by GitHubMedium 4.3
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnerability allows attackers to upload files with prohibited extensions by embedding them inside ZIP archives and extracting them using the application’s built-in decompression functionality. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24672 · Other software · gunet · reported by GitHubHigh 7.3
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when users with viewing privileges access affected application pages. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24671 · Other software · gunet · reported by GitHubMedium 6.1
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated high-privileged users (teachers or administrators) to inject malicious JavaScript into multiple user-controllable input fields across the application, which is executed when other users access affected pages. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24670 · Other software · gunet · reported by GitHubMedium 6.5
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability allows authenticated students to create new course units, an action normally restricted to higher-privileged roles. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24669 · Other software · gunet · reported by GitHubHigh 7.8
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password reset mechanism allows local attackers to reuse a valid password reset token after it has already been used, enabling unauthorized password changes and potential account takeover. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24668 · Other software · gunet · reported by GitHubMedium 6.5
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability allows authenticated students to add content to existing course units, an action normally restricted to higher-privileged roles. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24667 · Other software · gunet · reported by GitHubMedium 5
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24666 · Other software · gunet · reported by GitHubMedium 6.5
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows attackers to induce authenticated teachers to perform unintended actions, such as modifying assignment grades, via crafted requests. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24665 · Other software · gunet · reported by GitHubHigh 8.7
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious JavaScript into uploaded assignment files, which is executed when instructors view the submission. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-24664 · Other software · gunet · reported by GitHubMedium 5.3
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability allows unauthenticated attackers to identify valid user accounts by analyzing differences in the login response behavior. This issue has been patched in version 4.2.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins.CVE-2020-37116 · Websites & servers · reported by VulnCheckHigh 8.7
GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.openeclass.orgexploit-db.com
Feb 3, 2026GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption.CVE-2020-37115 · Other software · Openeclass · reported by VulnCheckHigh 7.1
GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and increases the risk of credential theft and unauthorized access.
- Product
- GUnet OpenEclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.openeclass.orgexploit-db.com
Feb 3, 2026GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and otCVE-2020-37114 · Other software · Openeclass · reported by VulnCheckMedium 5.3
GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. Attackers can retrieve system info, version info, and view or download other users' files without proper authorization.
- Product
- GUnet OpenEclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.openeclass.orgexploit-db.com
Feb 3, 2026GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files.CVE-2020-37113 · Other software · Openeclass · reported by VulnCheckHigh 8.7
GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the intended file type checks in the exercise submission feature.
- Product
- GUnet OpenEclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.openeclass.orgexploit-db.com
Feb 3, 2026GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parCVE-2020-37112 · Other software · Openeclass · reported by VulnCheckHigh 7.1
GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the agenda module and other endpoints to extract sensitive database information using error-based or time-based injection techniques.
- Product
- GUnet OpenEclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.openeclass.orgexploit-db.com
Jan 8, 2026The Open eClass platform (formerly known as GUnet eClass) is a complete course management system.CVE-2026-22241 · Other software · gunet · reported by GitHubHigh 7.3
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system. The main cause of the issue is that no validation or sanitization of the file's present inside the zip archive. This leads to remote code execution on the web server. Version 4.2 patches the issue.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System.CVE-2024-38530 · Other software · gunet · reported by GitHubCritical 9.8
The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's filesystem. This may lead in unrestricted RCE on the backend server, since the upload location is accessible from the internet. This vulnerability is fixed in 3.16.
- Product
- openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024Cross-site scripting (XSS) vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute aCVE-2024-33253 · Other software · gunet · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function.
- Product
- open_eclass_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2024File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.CVE-2024-31777 · Other software · gunet · reported by MITRECritical 9.8
File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.
- Product
- open_eclass_platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2022An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitrarCVE-2022-33116 · Other software · Openeclass · reported by MITREMedium 6.5
An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitrary files via a directory traversal.
- Product
- Openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemaragkos.grgithub.com
Jun 11, 2022GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.CVE-2021-44266 · Other software · Gunet · reported by MITREMedium 6.1
GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter.
- Product
- Open Eclass Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.openeclass.orgemaragkos.gr
Aug 19, 2020GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that theCVE-2020-24381 · Other software · Gunet · reported by MITREHigh 7.5
GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default.
- Product
- Open Eclass Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemaragkos.grgithub.com
Mar 31, 2017Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'.CVE-2017-7389 · Other software · Openeclass · reported by MITREMedium 6.1
Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
- Product
- Openeclass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.