Openeclass is an open-source learning management system deployed across educational institutions, and vulnerabilities affecting the platform skew strongly toward critical severity. The exposure concentrates in the core Openeclass product and recurs through web application weakness classes including unrestricted file uploads, cross-site scripting, and path traversal that are characteristic of server-side PHP applications handling user input and file management. Vulnerabilities in this space frequently acquire public exploit code; live exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Openeclass over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-31777CRITICAL File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint. | Jun 13, 2024 | 9.8 | 38 | NO | YES |
CVE-2026-22241HIGH The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import f | Jan 8, 2026 | 7.2 | 36 | NO | YES |
CVE-2024-38530CRITICAL The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P modu | Aug 12, 2024 | 9.8 | 28 | NO | NO |
CVE-2024-26503CRITICAL Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.p | Mar 14, 2024 | 9.1 | 25 | NO | NO |
CVE-2022-33116MEDIUM An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and below allows attackers to read arbitrary files via a direct | Jun 27, 2022 | 6.5 | 22 | NO | NO |
CVE-2017-7389MEDIUM Multiple Cross-Site Scripting (XSS) were discovered in 'openeclass Release_3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) | Apr 1, 2017 | 6.1 | 22 | NO | NO |
CVE-2025-65734MEDIUM An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to execute arbitrary co | Mar 16, 2026 | 5.4 | 19 | NO | NO |
CVE-2024-33253MEDIUM Cross-site scripting (XSS) vulnerability in GUnet OpenEclass E-learning Platform version 3.15 and before allows a authenticated privileged attacker to execute arbitrary code via th | Jun 13, 2024 | 5.4 | 15 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Openeclass.
Media articles that mention a CVE ID that affects a product developed by Openeclass — matched by CVE ID, not by vendor name.