The Open eClass platform (formerly GUnet eClass) course management system contains a stored Cross-Site Scripting (XSS) vulnerability in versions prior to 4.2. The vulnerability allows authenticated students to inject malicious JavaScript code into uploaded assignment files. When instructors view these submissions, the malicious code executes in their browsers. This stored XSS attack vector could potentially allow students to compromise instructor accounts or steal sensitive information. The vulnerability has been patched in version 4.2 of the Open eClass platform.