A reflected cross‑site scripting flaw exists in the Open eClass platform in all releases prior to version 4.2. The flaw permits a remote attacker to craft a malicious URL that includes arbitrary JavaScript, which executes when an authenticated user follows the link. This capability is a classic CWE‑79 weakness because user‑controlled input is reflected without proper output encoding.

The vulnerability applies to the gunet Open eClass platform, all versions older than 4.2. Any user running a pre‑4.2 build faces the risk of the reflected XSS flaw when exposed to malicious URLs.

The CVSS base score of 4.7 indicates a moderate risk level, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The issue is not listed in the CISA KEV catalog. The likely attack vector is indirect remote: an attacker must entice an authenticated user into clicking a crafted link. An effective fix is available in version 4.2, making upgrade the most straightforward mitigation.