Gunet vulnerabilities
We track 6 vulnerabilities in Gunet products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 3, 2026.
Latest Gunet vulnerabilities
- 7.5 High severity
openeclass: Authorization Bypass Through User-Controlled Key
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an Insecure Direct Object Reference (IDOR) vulnerability allows unauthenticated remote attackers to access personal files of other users by
- 7.8 High severity
The Open eClass platform (formerly known as GUnet eClass) is a complete course management…
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password reset mechanism allows local attackers to reuse a valid password reset token after it has already been used, enabling u
- 7.2 High severity
openeclass: Unrestricted Upload of File with Dangerous Type
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitr
- 9.8 Critical severity
openeclass: Unrestricted Upload of File with Dangerous Type
The Open eClass platform (formerly known as GUnet eClass) is a complete Course Management System. An arbitrary file upload vulnerability in the "save" functionality of the H5P module enables unauthenticated users to upload arbitrary files on the server's files
- 9.8 Critical severity
open_eclass_platform: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.
- 9.1 Critical severity
open_eclass_platform: Unrestricted Upload of File with Dangerous Type
Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint.