The Open eClass platform is vulnerable to a stored cross‑site scripting flaw that allows authenticated teachers or administrators to inject malicious JavaScript into several user‑editable fields. When other users view the affected pages, the injected code executes in their browsers, enabling attacks such as cookie theft, session hijacking, defacement, or further exploitation of client‑side resources. This vulnerability is a classic injection weakness (CWE‑79).

This flaw exists in all Open eClass releases prior to version 4.2. The affected vendor is Gunet, developer of the Open eClass platform. Users running any version older than 4.2 of Open eClass are susceptible, while version 4.2 and newer contain the patch that removes the susceptibility.

The CVSS base score of 6.1 places the issue in the medium severity range, and the very low EPSS (<1%) indicates that exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker have high‑privileged access (teacher or administrator) to inject the payload. Once injected, the code runs with the victim’s browser privileges, potentially compromising user data and session integrity. The presence of both a credential requirement and a stored payload further limits the attack surface but still poses significant risk to users of affected installations.