CVE-2026-24672

HighPublic PoC

Published: 03 February 2026

Published

03 February 2026

Modified

10 February 2026

KEV Added

—

Patch

—

CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

EPSS Score 0.0004 13.3th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24672 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Gunet Open Eclass Platform. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Browser Session Hijacking (T1185) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-79

Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.

SI-10 Information Input Validation

addresses: CWE-79

Validates web inputs to reject script-related content that could produce XSS.

SI-15 Information Output Filtering

addresses: CWE-79

Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.

MITRE ATT&CK Enterprise TechniquesAI

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Stored XSS directly enables browser-based session hijacking (T1185) and web session cookie theft (T1539) via injected JavaScript execution in victim browsers.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated students to inject malicious JavaScript into user profile fields, which is executed when…

users with viewing privileges access affected application pages. This issue has been patched in version 4.2.

Deeper analysisAI

CVE-2026-24672 is a Stored Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, in the Open eClass platform (formerly known as GUnet eClass), a complete course management system. It affects versions prior to 4.2, specifically in user profile fields that fail to sanitize input properly, allowing injected JavaScript to persist and execute.

Authenticated students can exploit this vulnerability by injecting malicious JavaScript into their own user profile fields. The payload executes in the browsers of users with viewing privileges when they access affected application pages, potentially leading to high confidentiality and integrity impacts such as session hijacking, data theft, or page manipulation. The CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) indicates network accessibility, low attack complexity, low privileges required, and user interaction needed, with no availability disruption.

The issue has been patched in Open eClass version 4.2. Additional details on the vulnerability and mitigation are available in the GitHub security advisory at https://github.com/gunet/openeclass/security/advisories/GHSA-3p2x-qgxw-qvxh.