已知漏洞
| CVE | 标题 | 受影响版本 | CVSS | 被利用 | EPSS | 发布日期 |
|---|---|---|---|---|---|---|
| CVE-2026-24669 | Open eClass Insecure Password Reset Token Reuse Enables Account Takeover | * | 7.8 | — | 2026-02-04 | |
| CVE-2026-24668 | Open eClass Broken Access Control Allows Students to Add Content to Course Units | * | 6.5 | — | 2026-02-04 | |
| CVE-2026-24667 | Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access | * | 5.0 | — | 2026-02-04 | |
| CVE-2026-24666 | Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actions | * | 6.5 | — | 2026-02-04 | |
| CVE-2026-24665 | Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Upload | * | 8.7 | — | 2026-02-04 | |
| CVE-2026-24774 | Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities | * | 4.3 | — | 2026-02-04 | |
| CVE-2026-24773 | Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files | * | 7.5 | — | 2026-02-04 | |
| CVE-2026-24674 | Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpoints | * | 4.7 | — | 2026-02-04 | |
| CVE-2026-24673 | Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction | * | 4.3 | — | 2026-02-04 | |
| CVE-2026-24672 | Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fields | * | 7.3 | — | 2026-02-04 | |
| CVE-2026-24671 | Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User Fields | * | 6.1 | — | 2026-02-04 | |
| CVE-2026-24670 | Open eClass Has Broken Access Control in Course Units Module Allows Students to Create Units | * | 6.5 | — | 2026-02-04 | |
| CVE-2026-24664 | Open eClass is Vulnerable to Username Enumeration via Login Response Discrepancies | * | 5.3 | — | 2026-02-04 | |
| CVE-2026-22241 | Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE) | * | 7.3 | — | 2026-01-09 | |
| CVE-2024-38530 | Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php" | * | 9.8 | — | 2024-08-12 | |
| CVE-2022-33116 | An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v... | * | — | — | 2022-06-28 | |
| CVE-2020-24381 | GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitt... | * | — | — | 2020-08-19 | |
| CVE-2017-7389 | Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist d... | * | — | — | 2017-04-01 |
数据来源：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS 详见 https://www.first.org/epss）、endoflife.date。软件列表：awesome-selfhosted（CC BY-SA 3.0）。