CVE-2020-37115: Plaintext Storage of a Password

GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and increases the risk of credential theft and unauthorized access...

CVE-2020-37114: Exposure of Sensitive Information to an Unauthorized Actor

GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, application version, and other students' uploaded assessments, due to improper access controls and information disclosure flaws in various modules. Attackers can...

CVE-2020-37113: Unrestricted Upload of File with Dangerous Type

GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php3 or .PhP, an attacker can upload a web shell and execute arbitrary code on the server. This vulnerability enables remote code execution by bypassing the...

GUnet OpenEclass 信息泄露漏洞

GUnet OpenEclass is a learning management system developed by the Greek company GUnet. Version 1.7.3 of GUnet OpenEclass contains a vulnerability related to information leakage. This vulnerability stems from improper access control and information exposure, potentially allowing unauthorized acces...

EUVD-2017-16416

Malware in sbrugna...

CVE-2024-33253

Cross-site scripting XSS vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function...

CVE-2024-31777

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint...

CVE-2024-31777

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint...

CVE-2024-33253

Cross-site scripting XSS vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function...

OpenEclass E-learning Platform Security Vulnerability

OpenEclass E-learning Platform is an integrated course management system from Open Eclass open source. A security vulnerability exists in OpenEclass E-learning Platform version 3.15 and earlier. An attacker exploited the vulnerability to execute arbitrary code via the title and description fields...

CVE-2024-33253

Cross-site scripting XSS vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function...

CVE-2024-31777

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint...

CVE-2024-33253

Cross-site scripting XSS vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function...

CVE-2024-31777

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint...

CVE-2024-33253

OpenEclass OpenEclass E-learning Platform (GUnet)

CVE-2024-31777

The GUnet OpenEclass e-learning platform (versions 3.15 and earlier ) is vulnerable to an unrestricted file upload vulnerability via the certbadge.php endpoint. An authenticated attacker with administrative privileges can exploit this flaw by using the ZIP functionality to upload crafted files, l...

PT-2024-25170 · Gunet · Gunet Openeclass E-Learning Platform

Name of the Vulnerable Software and Affected Versions: GUnet OpenEclass E-learning Platform versions 3.15 and before Description: The issue is a cross-site scripting XSS vulnerability that allows an authenticated privileged attacker to execute arbitrary code. This can be achieved via the title an...

CVE-2024-31777

File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint...

CVE-2024-33253: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function...

CVE-2024-33253

Cross-site scripting XSS vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via the title and description fields of the badge template editing function...