The Open eClass platform, a course management system, is affected by a stored XSS flaw. Prior to version 4.2, authenticated students can upload assignment files that contain malicious JavaScript. When an instructor opens the assignment, the injected script runs in the instructor’s browser, allowing an attacker to execute code within that context. This vulnerability is classified under CWE‑79 and may compromise the confidentiality and integrity of instructor sessions.

The vulnerable product is Open eClass from the gunet vendor. All releases older than version 4.2, including 4.1 and earlier, are susceptible.

The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated student account to upload a crafted assignment, and the impact manifests when an instructor views the file, executing the malicious script in the instructor’s browser.