The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site Scripting (XSS) vuln…

The Open eClass platform (formerly GUnet eClass) course management system contains a stored Cross-Site Scripting (XSS) vulnerability in versions prior to 4.2. The vulnerability allows authenticated students to inject malicious JavaScript code into uploaded assignment files. When instructors view these submissions, the malicious code executes in their browsers. This stored XSS attack vector could potentially allow students to compromise instructor accounts or steal sensitive information. The vulnerability has been patched in version 4.2 of the Open eClass platform.