Gunet
Gunet Open Eclass Platform: vulnerabilidades y CVE
Gunet Open Eclass Platform tiene 20 vulnerabilidades publicadas, 18 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE20
Últimos 12 meses18
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-24774 | Media (4.3) | 0.23% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a business logic vulnerability allows authenticated students to improperly mark themselves as… |
| CVE-2026-24773 | Alta (7.5) | 0.41% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows unauthenticated remote attackers to… |
| CVE-2026-24674 | Media (6.1) | 0.21% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Reflected Cross-Site Scripting (XSS) vulnerability allows remote attackers to execute arbitrary… |
| CVE-2026-24673 | Media (5.3) | 0.28% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnerability allows attackers to upload files with prohibited… |
| CVE-2026-24672 | Media (5.4) | 0.22% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious… |
| CVE-2026-24671 | Media (4.8) | 0.22% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated high-privileged users… |
| CVE-2026-24670 | Media (6.5) | 0.24% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability allows authenticated students to create new course units, an… |
| CVE-2026-24669 | Alta (7.8) | 0.18% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password reset mechanism allows local attackers to reuse a valid password reset token… |
| CVE-2026-24668 | Media (6.5) | 0.24% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access control vulnerability allows authenticated students to add content to existing… |
| CVE-2026-24667 | Media (5) | 0.15% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens… |
| CVE-2026-24666 | Media (6.5) | 0.18% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request Forgery (CSRF) vulnerability in multiple teacher-restricted endpoints allows… |
| CVE-2026-24665 | Media (5.4) | 0.22% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious… |
| CVE-2026-24664 | Media (5.3) | 0.29% | — | 3 feb 2026 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumeration vulnerability allows unauthenticated attackers to identify valid user… |
| CVE-2020-37116 | Alta (8.7) | 0.48% | — | 3 feb 2026 | GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to… |
| CVE-2020-37115 | Alta (7.1) | 0.29% | — | 3 feb 2026 | GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and… |
| CVE-2020-37114 | Media (5.3) | 0.38% | — | 3 feb 2026 | GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access… |
| CVE-2020-37113 | Alta (8.7) | 0.91% | — | 3 feb 2026 | GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the… |
| CVE-2020-37112 | Alta (7.1) | 0.32% | — | 3 feb 2026 | GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the… |
| CVE-2021-44266 | Media (6.1) | 1.0% | — | 11 jun 2022 | GUnet Open eClass (aka openeclass) before 3.12.2 allows XSS via the modules/auth/formuser.php auth parameter. |
| CVE-2020-24381 | Alta (7.5) | 1.4% | — | 19 ago 2020 | GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.